After wiping all data and losing access to a bunch of features and apps.

Including everything I could possibly ever want an Android device for, like my bank's 2FA program.

It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem).

These are tempting choices, but they go a lot further than, for example, requiring only modern TLS ciphersuites to be used to communicate with my servers. They dictate the state of your entire device, and no one app or company should have that power, unless you work for the company and they issue you the device -- but even then, modern MDM/MAM can and should sandbox company apps from the rest of the device.

When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboards look really fake.

“I didn’t like doing it” doesn’t make this any better. It’s just hammering another nail in the coffin of device ownership.

Please, our mediocre AA gatcha game did nothing to you nor the overall jailbreaking ecosystem. Don’t you think that’s being a bit dramatic?

They definitely overdramatised the wording, but their point is valid - the 'normalisation by a thousand cuts' is a real phenomenom, and a bad one.

I'll agree with that, but on my side I wasn't faced with a whole lot of options either.

As much as I want to agree with you, I can't blame Google here. Corporate security departments have bought into the idea that mobile is different and you can't trust the user with root.

Google has little choice but to provide them with the tools to detect root access.

Why? If Google didn't implement it, what would they do?

Not allow their cards in Google Wallet, and or only support web access to their functions.

Some of the entities that want it do have pull.

Exactly, you shouldn't waste your time with Android any more than with iOS at this point (same for banks that only provide 2FA on iOS/Android).

And while for years the alternatives have been almost nonexistent, we do have at least two now : PinePhone and Librem 5.

Magisk [0] + safetynet-fix [1] can work around that.

[0] https://github.com/topjohnwu/Magisk

[1] https://github.com/Displax/safetynet-fix

It's quite doubtful it will keep working.

Well people keep saying this for years now. When it stops working we'll make statements like "root breaks access to Netflix and Banking apps". But since it doesn't at the moment, everything is good.

But it does break them. That's what happens when you enable root, they break.

You have to use pretty shaky workarounds to trick them, and there is a known way to make those workarounds impossible.

As far as I've understood, the safetynet fix makes use of a feature which only exists for comparability reasons, so that old devices don't get locked out entirely. When there aren't enough old devices around anymore, it will likely stop working.

You do have to unlock the bootloader to root a device, hence wiping the data, but that doesn't matter if it's the first thing you do when you get the phone.

Features though? Maybe I don't realize all the great things I'm missing out on since I've only ever used rooted phones since I got my first Android device many years ago.

As for apps, I've only heard of certain games (I don't play games on my phone) and banking apps (thankfully mine doesn't care, though I'd rather use a desktop web interface for financial stuff).

Netflix is a big one.