zlacker

Most (all?) corporate endpoint security systems use it right in my experience. Even when using it right, you would have to block third party builds and cause outcry. You would additionally block some builds that SafetyNet (or Play Integrity) attests.

>>lern_t+(OP)
> Even when using it right, you would have to block third party builds

Unless you have an obvious and accessible way of getting secure third party builds whitelisted, this is still a very anti-user approach, which is not justifiable unless the user of the device isn't its owner (like with company-owned work phones).

>>franga+He
That's up to the service to decide on the appropriate level of security risk in whether they allow unknown builds. They already don't allow custom builds on any other mobile OS, so this is really the best you can get as a user. What is your proposed solution?

>>lern_t+xj
> They already don't allow custom builds on any other mobile OS ...

Keep in mind that Pinephones and similar are a thing. Lots of people are hoping they don't fizzle out and die off like previous "open" phone projects. :)

>>justin+UE
And Pinephones and similar don't have apps for these services that require attestation and never will. If some allow web access without build attestation, that works on custom Android builds as well.

>>lern_t+xj
> What is your proposed solution?

Ban attestation methods that owners can't control.

>>lern_t+(OP)
> Most (all?) corporate endpoint security systems use it right in my experience.

I've never seen a usage of Safetynet which I would consider right, pretty much everybody thinks it creates some kind of "security" whereas it doesn't.

One very rare useful usage for it could be removing bots for game leaderboards but certainly not banking apps.

>>Dylan1+Jb1
What does that even mean? It sounds like your proposal makes attestation pointless since owner can attest in whatever way they want.

>>hoffs+G12
It only makes it pointless for DRM purposes.

If a company wants control over devices they own, that's still fine.

>>Dylan1+Jb1
So regulation. I can get into that. Until such regulation exists, phone manufacturers have no incentive to maintain different SKUs.