SafetyNet vs MagiskHide: what's the status now in mid 2020?

(29 June 2020) It looks like Google is just being cautious, and preparing a new field in the SafetyNet response.

According to the SafetyNet API Clients Team

We have started rolling out a new feature that will provide developers with insight into the types of signals/measurements that have contributed to each individual SafetyNet Attestation API response.

Our JWS responses now have a new optional field named evaluationType.
The value of this field will be a list of comma-separated string tokens, where each token represents an enum-like value.

Currently, the following string tokens may be indicated::

• BASIC - When we use typical signals and measurements along with reference data during our evaluation.


• HARDWARE_BACKED - When we use the available hardware-backed security features of the remote device (e.g. hardware-backed key attestation) to influence our evaluation.

Examples of field values that you may expect:

• { “evaluationType”: “BASIC” }


• { “evaluationType”: “BASIC,HARDWARE_BACKED” }

We’re currently evaluating and adjusting the eligibility criteria for devices where we will rely on hardware-backed security features. So please do not use the presence or value of this field as a signal by itself (for now).

Note that this feature has not been officially documented yet. Presently, we’re only communicating it to this announcement-list to collect feedback.

We encourage you to use our feedback form based on your experience with this new feature as well as the overall service.

Thanks & Regards,
SafetyNet API Clients team

So once testing for this new feature is completed, it looks like hardware-backed key attestation will be put in place. Which means, from then on, SafetyNet would be able to detect bootloader/verified boot status even with MagiskHide enabled.

John Wu is still fighting back

(updated on 29 June 2020)

John Wu is trying to persuade Google to not blindly apply SafetyNet hardware-backed attestation across the board. He tweeted:

I advocate
@AndroidDev
to restrict hardware-backed SafetyNet evaluation to "real" security sensitive apps. Developers should go through an application process to qualify this level of API access. It is ridiculous for McDonalds to refuse to run on a bootloader unlocked device.

Meanwhile, it appears that the SafetyNet checks will still fail even if the bootloader is re-locked, as we see here, tweeted 3 July 2020

Bad news: it is confirmed that for those who wants to re-lock their bootloader with self signed images (possible on Pixel devices), SafetyNet with HARDWARE-BACKED evaluation will still NOT pass CTS check.

(Updated on 13 Dec 2020) John Wu now tweets

Let me get this out of the way: since I have a full time job now, I don't have much time for Magisk; I need prioritization. HW based evaluation is impractical to "hack" (except tricks to make it fallback to basic), and I lost all interest in improving the current way of hiding.