News for hackers. Stuff that matters.

A comment on Google shifting to “upstream first” Linux kernel approach for Android features. Parent comment

Re:Google shifting to “upstream first” Linux kernel approach... by danogentili on Thursday September 23, 2021 @06:49AM (#28627481)
You can't really do that with safetynet, as it relies on sending an (often signed with a hardware key) payload to the servers of the app, which then connect to Google's server for validation, before allowing access to the APIs the app requires.
[ Parent | on HN ]
Re:Google shifting to “upstream first” Linux kernel approach... by krageon on Thursday September 23, 2021 @07:31AM (#28627766)
The checks I've seen when I have explored the possibility of doing this (in an explicitly legal way, I had permission) were easily bypassable client-side. It's not generally a good idea to assume the heaviest option was picked when a simpler one could also have been picked.
[ Parent | on HN ]