Database Info

The War with Google has begun

We were lucky.
Google's security measures were pathetic and still are, but now, it has come to their attention that the security measures pose more of a problem than before. Google is attempted to block ADP users from having access to the market due to their potential to download any app for free.
Now, it has come to their attention that RC33 root users have the same ability. Security is now a top priority when it comes to google. They already have cupcake ready to go, that's done.
Google's probably realized by now that their security measures are simply pathetic. We're going to have to step up our game as they step up theirs.

What's the error you're getting? I'm getting that to visit checkout.google.com to fix the problem.
EDIT: That only happens with one app... ? Umm, do you have proof that they are blocking ADP users?

you're lucky. they probably filter ip's too. i can't even list paid apps.. (not from US)

Honestly how hard could it be to encrypt an app and get a certificate update for the premium apps you purchased to decrypt them every time your phone syncs with Google?

Root is google's problem right now.
No matter what they do with the premium apps, they can be cracked by root users.
Buy the app, pull the .zip, crack it. Refund the app. Throw it back in the phone and install.
End of story.
Google needs to eliminate root. We have the advantage of course.
We already have root, and we are hacking which is much easier than defending.
Google knows this, which is apparent from their android forums.

It's easier for google to tie the app to user's gmail account. So the app will only run if it's on a "I purcheased this" list... harder to crack if they add a file signature on top of that.
P.S.:
If google want's to hire me they know where to find me.. hehehe.

Can you elaborate or provide any info on what you are talkinng about before I close this thread?
I have an adp and rc33 phone, neither are having issues with the market.

neoobs said:
Can you elaborate or provide any info on what you are talkinng about before I close this thread?
I have an adp and rc33 phone, neither are having issues with the market.
Click to expand...
Click to collapse
i could say what to do but hmm ;o( dont wanna argue with no one

It's not paid apps. ADPs can't see protected apps on the market.

like which apps ? yes i know "protected" but wich one is protected so i can go and test cuz i was in the market few mins ago had no issues x_x

Seems to be more of a bug in the protection option rather than some thing google's doing to ban the sales of apps to adp customers.. there's a few related posts on the google groups site..

Nitro212 said:
like which apps ? yes i know "protected" but wich one is protected so i can go and test cuz i was in the market few mins ago had no issues x_x
Click to expand...
Click to collapse
Bettercut is a popular protected app. Can you see it? (if you have a rooted rc33 and you're in the US you should see it)

Its Google's own fault that we all have root.....they made one mistake...then we hacked it and exploited it to a extreme extent.
Rooted phones only take updates signed with test keys right...
So couldn't Google sign one of there O.T.A. updates with test keys and get rid of out root?

Well, they could but then how would they explain it to users without rooted phones who's phones were keep on rebooting and failing to install the test-key signed updates due to the method that Google can use to force the OTA updates?
And what about the users with ADP's? I'm pretty sure that Google wouldn't want to piss them off by forcing them to install a root-less regular update.

Ehhh Yea That Makes It Very Unlikely That Google Will Ever Do It ....But If They Ever Decide That Root Is A Serous Problem Then Its A Possibility

d00m said:
Bettercut is a popular protected app. Can you see it? (if you have a rooted rc33 and you're in the US you should see it)
Click to expand...
Click to collapse
yeah i see it, yes i have rooted rc33 and im in the us

there is no such thing as a crack-proof app. Every app can be cracked if you have the right skills. As soon as paid apps get going there will be loads of places online offering app downloads, just wait and see.
APrinceAmongMen said:
Security is now a top priority when it comes to google. They already have cupcake ready to go, that's done.
Click to expand...
Click to collapse
do you have some sort of incredible inside information that no one else knows about?
how do you know 'cupcake' is done and ready to go? last i heard they were no where near completion.

Most of the paid apps are a joke anyways. I bet I could make a program called Dont buy this app! and sell it for a buck and still sell a **** ton of them.

Please, I think your being a bit over dramatic here, Google can't take actions too far because it would really kill the whole point of android being an open source, for developers phone.
While sure they can always up the security, but theres always going to be a way inside the program unless they wanted to lock down making and installing new apps. If they wanted that they wouldn't add an option to install thirdy party apps.

Thread is closed until further info.
This looks to be a problem with developers and a feature they are trying to implement but failing. If you have an issue please contact the developer of the app.

[APP][1.6+] PDroid - the better privacy protection app - will you use it?

Hi,
I have recently developed a privacy protection application for Android.
You can use it to block access for any installed application to the following data separately:
Device ID (IMEI/MEID/ESN)
Subscriber ID (IMSI)
SIM serial (ICCID)
Phone and mailbox number
Incoming call number
Outgoing call number
GPS location
Network location
List of accounts (including your google e-mail address)
Account auth tokens
Contacts
Call logs
Calendar
SMS
MMS
Browser bookmarks and history
System logs
SIM info (operator, country)
Network info (operator, country)
For device ID, phone and mailbox number, SIM serial, subscriber ID and device location it also allows supplying custom or random values.
Unlike others (e.g., Permissions Denied or CM) this does not make applications crash when access to private data is blocked.
The following short video shows some of its functionality.
PDroid does not require ROOT or any Android permission to function, nor does it need any services running in the background. But it does require patching some ROM components, so that it needs to be ported to different devices. Currently it is available for Nexus One, Nexus S, Desire HD (Gingerbread) as well as Magic with CM 6.1 (Froyo).
So I am wondering if I should release it for public use and maybe port to other devices. I will only do so if you would like to use it, since it requires some fine-tuning to be more user-friendly. So please vote if you would like to use PDroid.

I would love to use this app on my galaxy s and tab.
Especially the point to give the apps random or custom information instead of just blocking the access is important.
If you need help testing the app on those mentioned devices just let me know
I hope you get enough positive feedback to port and continue developing this app.

I ll love to have such an app on my Xperia X10 mini pro (cyanogenmod 7)

so basicly it's a LBE replacement? The major disadvantage of that one is being closed-source. Do you plan to open-source yours?

I would like to give this app a shot too with my devices (Nexus S 4G, EVO 3D and Epic Touch 4G). Does not require root, but assume that root is ok? Also seen that you have for Nexus S, but was not sure if that implies to the NS4G as well. Looks promising.

XlAfbk said:
so basicly it's a LBE replacement?
Click to expand...
Click to collapse
Kind of. The functionality is similar to that of LBE while I tried to account for its disadvantages, such as not being able to disallow access to some data (e.g., system logs, incoming and outgoing call numbers etc.), requiring root or being unreliable since LBE requires its protection service to be running so that malicious apps still can steal data if they are started before LBE after boot.
XlAfbk said:
The major disadvantage of that one is being closed-source. Do you plan to open-source yours?
Click to expand...
Click to collapse
Most likely yes (depends on how much spare time I can allocale to this project).

Tahde said:
Does not require root, but assume that root is ok?
Click to expand...
Click to collapse
Yes, it won't interfere
Tahde said:
Also seen that you have for Nexus S, but was not sure if that implies to the NS4G as well.
Click to expand...
Click to collapse
Yes, basically any device, for which Android can be directly built from AOSP (and this includes Nexus 4G) is supported right now.

Love to see it for the T-Mobile G2x especially if it is open.

svyat said:
You can use it to block access for any installed application to the following data separately...
Click to expand...
Click to collapse
That's a nice list. I'd really like a version for my Motorola Defy.
How hard would it be to reuse the code to make it run like LBE, i.e. make an apk that works on every phone without having to patch ROMs for every type of device?

I too would like to use this app, sounds awesome. If you need any beta testers, I volunteer

rogier666 said:
How hard would it be to reuse the code to make it run like LBE, i.e. make an apk that works on every phone without having to patch ROMs for every type of device?
Click to expand...
Click to collapse
Impossible, since the actual application logic performing the data access control is based on the Android application framework and not the SDK. Plus, doing it the LBE way requires root and will never be 100% reliable. In other words, there is no way of creating a proper solution without patching the ROM.

I would like to have this for t-mobile US Vibrant since we're getting no Gingerbread love from t-mo or Sammy and I'm all flashed out with nothing else to do.

I would like to give your app a spin to see how it works

KB0SDQ said:
I would like to give your app a spin to see how it works
Click to expand...
Click to collapse
I am also interested in this app... Sounds very promising and I hope this will get ported for the G2/DesireZ, so I can get some freakin' privacy!
If I can help in any way, any way at all, I'd be very happy to do so.. I'm running CM7.1.0 on my DesireZ @ 1.2ghz...
Thanks a lot!

Looks great. I'd love to get that on my Thunderbolt (CM7) would there be anyway to block permissions like internet and SD card access, I know Cyanogenmod lets you disable them but you have to reset your phone after a change for them to take effect. Also I don't know if it falls into the scope of what this project is intended for but I've seen people ask about making certain apps work on 3G that only work on wifi or the other way around if you could make an app think it was using one or the other for a connection I think that would be very helpful to some folks.

I'd test this on the t-mo Galaxy S2 if you're willing to do it...
Sent from my SGH-T989 using xda premium

I guess this is TISSA (http://www.csc.ncsu.edu/faculty/jiang/pubs/TRUST11.pdf) ?
I would like to see for Desire , Great to have this kind of app! I'll help which ever way

IvanNCase said:
would there be anyway to block permissions like internet and SD card access
Click to expand...
Click to collapse
Not in near future. Doing that would require modifying the kernel and that, in turn, would make PDroid much less portable.
IvanNCase said:
Also I don't know if it falls into the scope of what this project is intended for but I've seen people ask about making certain apps work on 3G that only work on wifi or the other way around [...]
Click to expand...
Click to collapse
Nope, it doesn't
ukanth said:
I guess this is TISSA (http://www.csc.ncsu.edu/faculty/jiang/pubs/TRUST11.pdf) ?
Click to expand...
Click to collapse
Nope, I've developed PDroid completely from scratch as a part of my Master's Thesis.

svyat said:
Not in near future. Doing that would require modifying the kernel and that, in turn, would make PDroid much less portable.
Nope, it doesn't
.
Click to expand...
Click to collapse
Fair enough.
By the way how do you install this does the ROM patching need to be done by the original creator or done with a zip file through recovery?

svyat said:
Nope, I've developed PDroid completely from scratch as a part of my Master's Thesis.
Click to expand...
Click to collapse
That's great to hear. Good job done ! I can't wait to see you release. I'll surely try to port it for Desire

Help - suddenly getting a lot of spam messages

I recently unlocked fastboot and flashed a new rom (arrowOS) on my phone and I am suddenly getting a lot of spam text messages, sometimes up to four messages per day. They all say something similar like "voicemail message received, go to random website to hear it"
Has anyone had similar things happen after unlocking their fastboot or flashing a new rom?
Can anyone recommend how to stop the spam messages?
I would truly appreciate the help!

Embedded malware... down to the bone?
Good luck with that.

blackhawk said:
Embedded malware... down to the bone?
Good luck with that.
Click to expand...
Click to collapse
For real? If so... :'(
The thing is, I didn't start having this issue until I unlocked and flashed.

Flash another custom ROM. (Maybe your phone is infected by malware when plugged into your PC. This is due to your PC being infected. Use another PC to download and move the ROM to the phone, like the public ones in a public library. Also reinstall windows on your computer.)
If the problem persists, take your SIM card out and see if the issue fixed. If removing the sim card fixed it tell your mobile data provider that your phone number is hacked and request a new number and SIM card.

marc0polo said:
For real? If so... :'(
The thing is, I didn't start having this issue until I unlocked and flashed.
Click to expand...
Click to collapse
It came from somewhere. Could be a completely external cause like someone selling your email address*.
Many times the user provides their email address voluntarily. I just let Gmail's spam filter do it's thing... I don't care. I never open it or download and it dies on mass delete... I rather enjoy that.
I don't have issues with unwanted phone calls or texts... I'm rather aggressive and creative with them. I break telemarketers for fun
Custom roms are an invitation for trouble of all kinds. The smaller their distribution, the less users to find potential issues and fixs.
Bottom line, if it seems like a bad idea, it probably is
*or phone number

It might be the OP downloading some drivers, ROMs etc, when trying to flash the ROM, from a malicious site, which downloaded malware into the computer and infected the phone instantly when he plugged the phone into his computer.
(In fact I fried my PC by downloading malware to my pc and tomorrow bump the motherboard is fried. Be careful when downloading.)

blackhawk said:
Custom roms are an invitation for trouble of all kinds. The smaller their distribution, the less users to find potential issues and fixs.
Click to expand...
Click to collapse
Well it might be a coincidence but MIUI crap is also the heaven of bugs, lags, ads, and trackers. They indeed have a large distribution, but the computer class of Xiaomi developers are surely teached by their PE teachers. Xiaomi firmware updates are also prone to bricking devices.

LR7875 said:
Well it might be a coincidence but MIUI crap is also the heaven of bugs, lags, ads, and trackers. They indeed have a large distribution, but the computer class of Xiaomi developers are surely teached by their PE teachers. Xiaomi firmware updates are also prone to bricking devices.
Click to expand...
Click to collapse
Redirect Notice
The CCP is the worlds largest data miner. They are insidious, pervasive and unrelenting.

LR7875 said:
Flash another custom ROM
Click to expand...
Click to collapse
blackhawk said:
Custom roms are an invitation for trouble of all kinds.
Click to expand...
Click to collapse
Yeah, I'll try flashing a different one next. It's a shame because ArrowOS is one of the more popular ROMs for poco and I was hoping that it would have good support/maintenance/security.
Something else it could be is just that my phone number got leaked somehow, which is not necessarily related to the new ROM.

marc0polo said:
Yeah, I'll try flashing a different one next. It's a shame because ArrowOS is one of the more popular ROMs for poco and I was hoping that it would have good support/maintenance/security.
Something else it could be is just that my phone number got leaked somehow, which is not necessarily related to the new ROM.
Click to expand...
Click to collapse
Try blocking the numbers. Many times they are spoofed. Try getting contact info on them.
Block unknown numbers.
Get on the national do not call list.
Contact your carrier and see if they can help. Some are quit aggressive with this.
I've had the same number for close to 20 years. I slice and dice unwanted callers with pleasure.
Great for taking out pent-up aggression... you can say whatever you want although I avoid death threats. There are more effective methods Cursing like a Marine is perfectly acceptable... but only if you mean it.
Texters are bots and ******* though.
Best to ignore and directly delete the message without opening. Never open attachments of any kind... ever. Or click on links... ever.
Disable multimedia in texting if possible.
Check your download folder regularly, look for odd behavior and unknown downloads; delete any found without opening.
Odd behavior indicates you may have downloaded malware like a scripted jpeg. Never let one of these get in your database

marc0polo said:
I recently unlocked fastboot and flashed a new rom (arrowOS) on my phone and I am suddenly getting a lot of spam text messages, sometimes up to four messages per day. They all say something similar like "voicemail message received, go to random website to hear it"
Has anyone had similar things happen after unlocking their fastboot or flashing a new rom?
Can anyone recommend how to stop the spam messages?
I would truly appreciate the help!
Click to expand...
Click to collapse
I'm running ArrowOS and have none of these problems. In the whole ArrowOS thread, you will not find a problem like yours.
Meaning the ROM is perfectly fine and the problem is on your end and completely independent from the ROM

Question Wi-Fi calling in non supported country

Hi
i want to enable wifi calling but cant
the option doesn't exist on the SIM menu.
i come from zenfone and xiaomi devices, in both cases i have just typed some dialer codes and the option appeared. wifi calling worked just fine.
in my pixel 6a i cant find any dialer code and all i see is rotting options. i dont want to root my device in order to not loose Gpay/banking and / or my work profile.
any solutions? wifi calling is important for me..

*#*#4636#*#*
This is the same way to get into the phone info settings forever. The WiFi calling provisioning toggle is there, but not sure your can change it.

ctfrommn said:
*#*#4636#*#*
This is the same way to get into the phone info settings forever. The WiFi calling provisioning toggle is there, but not sure your can change it.
Click to expand...
Click to collapse
nope. cant change it

Google Voice is a good option for generic wifi calling/VoIP...if it's available where you are.

noamazulay24 said:
nope. cant change it
Click to expand...
Click to collapse
Bummer....thats usually a carrier thing.

Google's been blocking various connectivity features (such as 5G, VoLTE, VoWIFI) in countries that are not "Pixel official".
They've been doing this for years now (since the first Pixel), and it seems that there's not intention on their part to enable it any time soon.
https://www.reddit.com/r/Android/comments/x1wpzq
Feel free to unreluctantly join tens/hundreds of thousands Pixel users that figured this out a little bit too late. With all due respect, Google can go **** themselves and I will never purchase one of their (physical) products unless they change this ridiculous policy.
P.s., there are plenty of mods (with root) that can enable all these connectivity features in Pixels in unofficial countries, just conduct a proper research before. Most (if not all) cell providers that support all these features with other brands support Pixel too, it's only on Google's end.

NuclearBastard said:
Google's been blocking various connectivity features (such as 5G, VoLTE, VoWIFI) in countries that are not "Pixel official".
They've been doing this for years now (since the first Pixel), and it seems that there's not intention on their part to enable it any time soon.
https://www.reddit.com/r/Android/comments/x1wpzq
Feel free to unreluctantly join tens/hundreds of thousands Pixel users that figured this out a little bit too late. With all due respect, Google can go **** themselves and I will never purchase one of their (physical) products unless they change this ridiculous policy.
P.s., there are plenty of mods (with root) that can enable all these connectivity features in Pixels in unofficial countries, just conduct a proper research before. Most (if not all) cell providers that support all these features with other brands support Pixel too, it's only on Google's end.
Click to expand...
Click to collapse
tnks!
do pixel 6a have a proper root option without loosing gpay and bangink apps?

noamazulay24 said:
tnks!
do pixel 6a have a proper root option without loosing gpay and bangink apps?
Click to expand...
Click to collapse
Oh sh*t, lol, didn't notice your name is נועם Guess we're on the same boat here in Israel.
I think that there is a way to do it, but as far as I know, the current solution is only temporary until Google blocks it all over. XDA's servers are giving me a hard time right now, but try to look for it somewhere on Pixel 6/6 Pro forums, just saw it yesterday.
In any case, I suspect that Google's intentions for not enabling connectivity on "non Pixel-official countries" has to do with their Fi network:
Redirecting

NuclearBastard said:
Oh sh*t, lol, didn't notice your name is נועם Guess we're on the same boat here in Israel.
I think that there is a way to do it, but as far as I know, the current solution is only temporary until Google blocks it all over. XDA's servers are giving me a hard time right now, but try to look for it somewhere on Pixel 6/6 Pro forums, just saw it yesterday.
In any case, I suspect that Google's intentions for not enabling connectivity on "non Pixel-official countries" has to do with their Fi network:
Redirecting
Click to expand...
Click to collapse
Oh **** indeed!

noamazulay24 said:
tnks!
do pixel 6a have a proper root option without loosing gpay and bangink apps?
Click to expand...
Click to collapse
You can unlock bootloader, install magisk, patch boot img and boot it for rooting. Use Shamiko for bank apps to work.

Why you shouldn't install banking apps on rooted phones

The latest type of hack, something I always thought was not possible, is to infect someone's phone with a mere phone call. You can read about it here.
There are very good reasons why banking apps refuse to work on phones with an unlocked bootloader. Installing random tools/ mods from unknown developers (XDA is no exception) to bypass built-in security to make them work is a very bad idea.
If you absolutely must root your main device (although I don't see too many benefits of rooting in 2023), it is advisable that you buy a 2nd phone and use that for your banking (or anything to do with money and other important things) needs. Even a super budget Android phone, COMPLETELY STOCK, will be fine.
Here's an analogy:
It is very important to follow speed limits on roads. The limits have a scientific basis and anyone who follows it will mostly be able to avoid a fatal accident. Just because accidents won't necessarily happen if the speed limit is breached, doesn't mean it is a safe thing to do.
The single biggest reason responsible for 99% of fatal accidents is overspeeding! If speed was under control, it is very highly likely that there won't be fatalities.

Applies to some Exynos models only. Details are vague. Banking, shopping and social media apps should never be installed anyway. You are what you load...

blackhawk said:
Applies to some Exynos models only. Details are vague. Banking, shopping and social media apps should never be installed anyway. You are what you load...
Click to expand...
Click to collapse
That is only in this case. Snapdragon models are not immune.

TheMystic said:
That is only in this case. Snapdragon models are not immune.
Click to expand...
Click to collapse
Documentation please...

Even if you were to post and reply about it daily in threads, there would still be similar questions about non-working apps with root or unlocked bootloader.
It's sad.

blackhawk said:
Documentation please...
Click to expand...
Click to collapse
Documentation in support of what? That Snapdragon phones are not immune? Are you implying Snapdragon phones are immune?
I'm not talking about this particular vulnerability specifically.

TheMystic said:
I'm not talking about this particular vulnerability specifically.
Click to expand...
Click to collapse
Exactly my point. This isn't a Snap vulnerability at all. Not all unpatched Exynos are vulnerable to it either.
There are multiple workarounds for most vulnerabilities for Android 9. Last time this phone was updated was 11/2019. It's current load will be 3yo in June. Zero malware so far.
Upgrades would've caused me far more lost time and inconvenience than any malware could even if the load only lasted 1 year or less.
The newest firmware isn't immune and may bring new huge vulnerabilities with it. Not doing stupid things is the best protection there is; most victims inadvertently install the malware themselves.

blackhawk said:
This isn't a Snap vulnerability at all.
Click to expand...
Click to collapse
This post isn't about this vulnerability either. It was referenced just as an example of zero day vulnerabilities that any connected tech can be a victim to.
blackhawk said:
Not doing stupid things is the best protection there is
Click to expand...
Click to collapse
Receiving a phone call isn't stupid in any way. Something like this shows that the tech we use everyday isn't as safe as we assume it to be

TheMystic said:
This post isn't about this vulnerability either. It was referenced just as an example of zero day vulnerabilities that any connected tech can be a victim to.
Click to expand...
Click to collapse
No shopping, banking, social media apps mean none multi vector vulnerabilities they bring. None of these apps are needed.
TheMystic said:
Receiving a phone call isn't stupid in any way. Something like this shows that the tech we use everyday isn't as safe as we assume it to be
Click to expand...
Click to collapse
It's a very hardware specific vulnerability. Data bandwidth over the VoLTE is limited. Just hang up. Block unknown numbers, which you should be doing anyway. Delete unknown or untrusted texts without opening.
Google is more hype than fact... wholesale purveyors of disinformation and lying by omission. It's rampant.

blackhawk said:
Block unknown numbers, which you should be doing anyway. Delete unknown or untrusted texts without opening.
Click to expand...
Click to collapse
Not a practical suggestion for most users.

TheMystic said:
Not a practical suggestion for most users.
Click to expand...
Click to collapse
That means numbers with no attached caller ID are blocked...
I'm more tolerant to play with spam in Gmail but not with texts. They are at a much higher risk level.

blackhawk said:
That means numbers with no attached caller ID are blocked...
Click to expand...
Click to collapse
I'm not sure what you mean here. Does your SIM provider have any caller ID service? Mine doesn't. I don't use Google Dialer and certainly not Truecaller, which I consider a spyware.
I do receive lots of calls from unknown numbers, and though many of them are useless marketing calls, some are indeed useful. So I block numbers after attending calls when I know I don't want to hear from them again.

TheMystic said:
I'm not sure what you mean here. Does your SIM provider have any caller ID service? Mine doesn't. I don't use Google Dialer and certainly not Truecaller, which I consider a spyware.
I do receive lots of calls from unknown numbers, and though many of them are useless marketing calls, some are indeed useful. So I block numbers after attending calls when I know I don't want to hear from them again.
Click to expand...
Click to collapse
Unless the caller blocks their caller ID I can see their number. If they block caller ID they are automatically blocked; the call is registered in call history but it doesn't ring.
More over if they phlish a number and get through they generally regret it. I rather enjoy that. Sometimes I take spam calls for sport.
Been doing that for decades

blackhawk said:
Unless the caller blocks their caller ID I can see their number. If they block caller ID they are automatically blocked;
Click to expand...
Click to collapse
You mean calls where we see 'Unknown number' on screen? I think that is a thing of the past now. Today, tech allows such scammers to make internet calls that show up as real numbers (which actually don't exist) complete with country code and city code. And the same tech also allows them to call from different number each time.

TheMystic said:
You mean calls where we see 'Unknown number' on screen? I think that is a thing of the past now. Today, tech allows such scammers to make internet calls that show up as real numbers (which actually don't exist) complete with country code and city code. And the same tech also allows them to call from different number each time.
Click to expand...
Click to collapse
I covered that. Excepting unknown callers is unacceptable today.

blackhawk said:
I covered that. Excepting unknown callers is unacceptable today.
Click to expand...
Click to collapse
That's true. I haven't received a call like that for a very long time now. May be 5 years or more.

TheMystic said:
There are very good reasons why banking apps refuse to work on phones with an unlocked bootloader.
Click to expand...
Click to collapse
My banking app needs minSdkVersion={R.0x18} or let's say min. Android 7. When using an older device with Android 7 for my banking app, would it be unsecure to unlock my bootloader to install a more secure firmware?

WoKoschekk said:
My banking app needs minSdkVersion={R.0x18} or let's say min. Android 7. When using an older device with Android 7 for my banking app, would it be unsecure to unlock my bootloader to install a more secure firmware?
Click to expand...
Click to collapse
Just login online instead using Brave.

blackhawk said:
Just login online instead using Brave.
Click to expand...
Click to collapse
And my TAN app?
An unlocked bootloader isn't unsecure at all. An attacker has got no benefits regarding banking apps on an unlocked or rooted device. Sensitive app data is stored encrypted by the app itself and even root access wouldn't help to read it. Transactions need a TAN that is only valid for the current transaction and only for a very limited time. You can't generate TANs for future transactions.
However, an attacker cannot gain access to your device via an unlocked bootloader. He gains access via an unpatched vulnerability.
Regarding the day-0-exploits: This is almost in every case a very, very theoretical construct and not executable in real life. All patches since 2015 are documented very detailed. You can download the patched and also the unpatched source code for this. It's like a instruction that tells you how to do it. But it seems that no one is able to implement it. Since 8 years Google releases every month new patches for new vulnerabilities. There are hundreds of it but they have never been used.

WoKoschekk said:
My banking app needs minSdkVersion={R.0x18} or let's say min. Android 7. When using an older device with Android 7 for my banking app, would it be unsecure to unlock my bootloader to install a more secure firmware?
Click to expand...
Click to collapse
What do you mean by 'a more secure firmware'? The most secure firmware is what your OEM released for your device. If your device is old and is no longer updated by the OEM, it can still be used safely as long as you keep everything stock and don't install random apps.
WoKoschekk said:
an attacker cannot gain access to your device via an unlocked bootloader. He gains access via an unpatched vulnerability.
Click to expand...
Click to collapse
A device with an unlocked bootloader makes it more vulnerable, and therefore more easily compromised by bad actors.
There should be reasons why banking apps don't want to work on an unlocked device, isn't it? Those apps are developed by professionals who know much more than most of us do. It is better to be safe than sorry.
WoKoschekk said:
There are hundreds of it but they have never been used.
Click to expand...
Click to collapse
Which means we shouldn't take things for granted. And definitely not increase the vulnerabilities even more by breaking the built-in defenses ourselves.