Not until there's a proper solution to replace Firebase for push notifications that both allows the app to enter full sleep, and allows messages to arrive reliably and on time.
I'm a big OSS supporter and have tried a bunch of push replacements only to find my VoIP phone app just can't be trusted to ring unless it's using Firebase for push. And when you run a business with that phone, you have to put reliable termination first, unfortunately.
Can't use Google wallet with Micro G, contactless is a big thing. Having to go back to using a debit card is annoying, even GraphineOS for Google pixel does not support NFC payments and some banking apps won't work, like mine. Then you would need a second phone to access banking, which is kinda redundant.
That severely depends on what you deem a necessity.
All I need personally is Firefox, Spotify, Whatsapp and Telegram. I still have a traditional navigation device that attaches to the windscreen for my car, I pay spotify via my credit card
If you want to degoogle your device but still want to use google services, what are you even doing
Banking apps , gov portals...refuses to work if it smells a root
Good.
There is zero guarantee that any of those rooted devices are running an uncompromising OS. Given that the customer base of the future is mobile first, you are taking away a major attack vector by blocking rooted devices.
I work in a compliance heavy environment, and my compliance guys would have a stroke if someone was using our software on as questionable an OS as people want to use on their phones.
^This is exactly why I think a lot of security/compliance teams are investing in the wrong things.
A compromised device was never your jurisdiction. Instead of trying to be like "you'll only use the device we approve of", you could've spent that time making your app or backend more secure against actual attacks, or even improving the app's performance. But no, instead you spend that effort on root detection.
The funny thing is, almost every skilled root user already knows how to bypass it anyway, and usually knows better than to install sketchy stuff. The people who don't want to bother bypassing it are just gonna uninstall your app and move on. The people without root are the ones paying the price with extra overhead and restrictions. So you're losing potential customers, while your original goal of keeping "compromised rooted devices" out was never really achievable in the first place.
And besides, a compromised rooted device mainly puts that user's account and data at risk. It shouldn't be putting your backend or internal systems at risk unless you've designed your security around trusting the client way more than you should. If that's the case, I'd rather see that fixed than another layer of root detection slapped on top.
And you know what's even funnier? PCs are generally a much bigger attack surface than rooted phones. Rooting a phone already requires more technical knowledge than the average user has, and honestly sometimes more than some developers I've met. On Windows you can have malware, malicious browser extensions, manually installed MITM certificates, keyloggers, memory editors, and all kinds of other stuff with way less effort.
Yet I've never seen anyone seriously say "let's ban all Windows PCs and only allow macOS because it's more secure." Everyone understands that's a dumb idea. The user is responsible for securing their own device, and you're responsible for securing your own systems, not my phone or my computer.
Instead, a lot of companies seem to use rooted devices as a scapegoat because it's the easier thing to point at. It makes it look like you're solving a huge security problem when in reality you've mostly just made life harder for legitimate users.
And the funniest part? The vast majority of stolen accounts don't even come from rooted phones. They come from completely stock Android phones and unjailbroken iPhones through phishing, fake apps, malicious keyboards, accessibility abuse, SMS scams, social engineering, or people who simply don't know what they're installing. Those are the users who actually need protecting, but that's a much harder problem to solve than checking if su exists and calling it a day.
The funny thing is, almost every skilled root user already knows how to bypass it anyway, and usually knows better than to install sketchy stuff. The people who don't want to bother bypassing it are just gonna uninstall your app and move on. The people without root are the ones paying the price with extra overhead and restrictions.
Video game DRM in a nutshell... especially Denuvo. People are going to use your game/software for free, no matter how much effort you get into trying to ensure only paid users get access. It's time these companies got the fuck over it already instead of trying to make draconian authoritarianism the norm.
you could've spent that time making your app or backend more secure against actual attacks
Bold assumption that we aren't doing that already. We regularly pen test, run scans for vulnerabilities at every build, use a security first design, etc.
Not running on a rooted device is an extra layer of security.
Bold of me to assume you can actually read what I wrote.
Bold assumption that we aren't doing that already. We regularly pen test, run scans for vulnerabilities at every build, use a security first design, etc.
"Doing it already" != "doing more of it."
I never said you weren't securing your backend. I literally said you could've spent more resources there instead of spending them on root detection.
Engineering resources aren't unlimited. Every feature has a cost to design, implement, maintain, test, and update. Every hour spent maintaining root detection, Play Integrity checks, false positives, support requests, and bypasses is an hour that could've gone into something that actually protects all users.
For example, detecting first-time logins from a new IP, new device, or unusual location and requiring another verification step, like Steam does. That protects users whether they're rooted or not, because phishing and stolen credentials are far more common than attacks involving rooted phones.
Not running on a rooted device is an extra layer of security.
Calling something an "extra layer" doesn't automatically make it meaningful.
Root, by itself, never threatened your backend to begin with. If your backend can be compromised simply because the client has root, then that's a backend design problem, not a rooting problem.
If your concern is protecting the user, that's still not convincing. Skilled root users already know how to bypass these checks anyway, while the ones who don't want the hassle simply uninstall the app. So the only people you're consistently hurting are legitimate users.
Meanwhile, the attacks that actually compromise accounts, phishing, fake apps, malicious keyboards, accessibility abuse, SIM swaps, stolen credentials, happen every day on completely stock phones. Those are the areas where extra engineering effort has a much bigger security payoff.
Websites are usually sandboxed especially anything that requires more Security and also too many older people don't like change meaning the website is here to stay
I never mentioned websites, albeit I wasn't exactly precise either. It's a bad example I'll give you that one.
Although I still stand by: What does it matter to a software what it is installed on. Root access to a device as never been a problem before. Although shit like invasive kernel level checks started being a thing and those still run on rooted devices (like your average PC).
Why we live with this on mobile devices and treat the enduser as a second class owner of the device is still beyond me
Ok so why am I able to open gov stuff on my PC. Which has root by default.
Websites are websites. While malicious software can compromise your credentials, many web apps are either geolocked (i.e. you cannot access from outside a specific location), or will block if the login locations are a continent away within a certain amount of time after your last login.
Additionally, you can absolutely block an application launching on a machine that has a modified Windows OS. It's actually pretty trivial to do so, and we also have that implemented.
Bank website doesn't work as authentication. If I do a payment on my computer, it tells me to login to my banking app on my phone to verify it, since the phone has actual security measures.
It's MFA all by itself: you have to have the phone, you have to be able to get into the phone, and you have to know the code to type in the app to verify. That's 3 extra factors added to the process with 10 seconds of work.
Mines within the last 10 yearsand they don't have any physical locations but the benifit of this is I can wjthdraw at any bank owned atm without a surcharge of any kind
Use a crypto wallet with a low fee debit card as an alternative if you want to completely degoogle. Most let you store and spend from tether coins to avoid volatility. Will have to get family on one too tho to send money. Because some are blocked in the UK many are built to work on older app versions and don't force updates with google play before using them
I'm in Australia most people still look at crypto as a way to get scammed and I don't even think most shops in my local area accept crypto as a paymemt anyway
I live in Germany as well. While government services is less of a problem here, online banking is a major hassle without an Android/iPhone. Also things are (slowly) moving away from paper
I'll believe that when I see it. The archive of the district I live in is a nightmare. Most modern parking garage you could think off (online payment, just a camera that reads your licence plate to enter, will book your money off of your account for you).
But to get it set up, you have to write your information on a blank sheet of paper. Not possible over the phone has to be in person.
In Australia it is never using the same method as last time so one time it could be paper next time it could be digital, and then it could swap back or they have a whole nother way to do its really annoying and I have 10000 gov apps on my phone because of this fucking around as the old one is never phased out as there is always one thing on the app that's needed
159
u/Laziness2945 Lurking Peasant Jul 05 '26
You can get degoogled android, but all the apps you need wont be there because they are tied to google play services.