As widely reported on different sites, and also discussed on this site (here and here), earlier this year, Google made changes to SafetyNet so that it could detect bootloader/verified boot status even with MagiskHide enabled. The developer of Magisk, John Wu, at that time tweeted that because Google was using the Trusted Execution Environment (TEE), its check on bootloader status could not be defeated. For example, he wrote:
this new update utilizes hardware-based key attestation. It will send an unmodified keystore certificate to SafetyNet servers, verify its legitimacy, and check certificate extension data to know whether your device have verified boot enabled (bootloader status)
Unless there is serious implementation bugs in your ARM TrustZone (or security co-processor like Google's Titan M), you cannot break the cryptography.
He basically concluded:
Let's face it. Fun is over guys.
Yet, on March 14, John Wu tweeted:
So apparently CTS is just passing again out of nowhere? Maybe Google is still testing things out?
I'm over it anyways. Google is apparently willing to use key attestation for detection. Since MagiskHide is still there, people can still always use it as usual.
And another tweet from him on April 3 that I didn't quite understand:
THE BIG GOOGLE HAMMER IS BACK! Say bye bye to SafetyNet, we'll (not) miss you...
Did that mean Google would somehow be removing SafetyNet, or at least not utilizing its capabilities to detect bootloader status?
So there was some doubt beginning to surface in mid March. In my own test in late May 2020, with MagiskHide not enabled, SafetyNet failed, but with MagiskHide enabled and targetting my test app, SafetyNet passed, meaning that MagishHide could still defeat SafetyNet. The test was run on a Pixel 3 with android 10.
So, Google may have the capability to detect MagiskHide, and it was working out in the field with real devices, but they have somehow stopped doing that? Does anyone know what is going on with SafetyNet? Was the feature temporarily reverted? Will it be coming back to SafetyNet, and if so, when?