0

According to an Android Pay engineer on the XDA forums, Android Pay is not compatible with rooted devices because of security concerns: on unrooted devices apps run in a sandbox and can only obtain limited information.

How is this different on an unrooted device as apps must request permission from SU?

Could an app trick SU into giving it more permissions than possible?

I am interesting in getting Android Pay working on my phone but have concerns about the security of my data as my device is rooted.

Improve this question
2
  • Adding cards to Android Pay on rooted device at least related, maybe duplicate.
    – NH.
    Jan 25, 2018 at 16:34
  • I don't think it's a duplicate, because the other question is about getting it to work, while this question asks what the security risks are.
    – Dan Hulme
    Jan 26, 2018 at 9:56

2 Answers 2

Reset to default
0

By default, only the application itself (and, under some circumstances, the applications written by the same company) can access to its (private) data. So Google Pay can store securely banking-related information.

If you root your phone, however, any application with root access can access to any folder on your file system. Including applications private data. And Google Pay's banking-related information.

I have no idea what Google Pay stores. But there is at least a way to authenticate as yourself. From there, an application with root access could probably do nasty things. Not nasty for Google, but for you: make payments on your behalf.

If you find a way to hide the root from Google Pay (I don't know if it's achievable, but I wouldn't be surprised if it was), and are entirely trusting the applications you give root access to, sure, go ahead. Personally, I would not.

Improve this answer
2
  • So to me it seems that it's quite safe to run Pay on a rooted device as long as the apps you've been root access to are 100% trusted apps. Am I wrong?
    – user179549
    Sep 1, 2016 at 7:25
  • Don't forget you also have to trust your superuser app to not have any security vulnerabilities that would allow an unauthorised app to get root access.
    – Dan Hulme
    Jan 26, 2018 at 9:58
-1

This is a problem with Knox. Google is liable if Google Pay is cracked on a device and maleficence was done i.e. rooted user steals or gets stolen from BY using the application etc. The only way to protect themselves is to eliminate access with modified OS. I don't see a way,other than going into the application and finding out if you could change what the application sees. My thinking is if the application can't get root, or isn't shown the device is rooted then it should work.

Improve this answer

You must log in to answer this question.