Hacker News Reader

Comment by eXpl0it3r | Hacker News Reader

I was quite happy to use LineageOS for my Nexus 5X and it worked great up to the point where my bootloader was now unlocked and certain apps, like for the bank or remote access apps, did not work anymore, as they considered the device unsecure. Do other phones allow you to flash the bootloader checksum, so you can lock it again?

View on HN

There are a few AVB 2.0 devices that will allow this, including the Pixel series, and the OnePlus 5T, but it can be risky. GrapheneOS works seamlessly with it, allowing you to relock the bootloader and only accept signed-OTA updates.

You may be interested in the Magisk [0] project which allows your device to pass Google's "SafetyNet" and present as an unmodified device to apps using that API to detect if they should refuse to run for "security" reasons.

0. https://github.com/topjohnwu/Magisk

Note that Google SafetyNet is now (as of mid-March 2020) requiring hardware-based remote attestation in order to pass their "CTS" check. This check will fail if the bootloader is not in its default "locked" state, and cannot be feasibly bypassed by Magisk. https://github.com/topjohnwu/magisk_files/blob/master/notes....

Magisk (and even its 'hide' component) will still be useful for many purposes, but we should not be expecting it to pass all such "safety" checks.

As a sibling comment suggested, using Magisk Hide lets you conceal your rooted status from those apps. Had this happen with my banking apps, and can confirm (on my Nexus 5x) that Magisk Hide did allow me to use those apps.

As for reflashing, you have to have a copy of the original image, for the device which you can download from various places, but once you have it, you may reflash it back to factory and relock.

Aren't those banking apps usually simply check whether root is available on the device and bail if they found it? You might be able to circumvent it using magisk to hide root, or simply don't install root support when installing lineageos (that's what I do as I don't need root anymore these days, and I haven't found any app that complains about insecure rom yet, Safetynet status is also passed).

Make sure to check out Magisk.

Reply on news.ycombinator.com