I have yet to find an app that does not work in LineageOS 20 on an FP4 with Universal SafetyNet Fix, Shamiko, and Props Config set to an FP3 signature (and MindtheGapps). Some banking apps that check for root/magisk outside of SafetyNet do seem to require being added to the Magisk blacklist, but that’s all that seems to be required. This includes access to Google Pay (yes, I have successfully made NFC payments with this configuration).
There’s always the chance that this will fail at some point in the future, but for now, everything is working.
Are 3rd-party ROMs (such as CalyxOS) able to acquire such a thing?—or does that mean that Google Pay is deliberately limited to 1st-party software from large organizations?
From my understanding, there is essentially no chance that non-manufacturer distributions would be given SafetyNet certification by Google. The privacy goals of CalyxOS would also be fundamentally incompatible with SafetyNet, so they would not seek it to begin with.
It is specifically the encryption that makes bootloader locking, or more generally verified boot processes, important. Without encryption, physical access is fatal to security, because the attacker can just read and write everything directly. With encryption, the next vulnerability becomes an evil maid attack, where an attacker with physical access changes the firmware secretly, and then waits for the user to unlock the device and for the storage to be decrypted.
However, on the FP4, the verified boot private keys are publicly available, and Fairphone apparently has no intention of addressing this problem. So a locked bootloader on an FP4 is arguably not that much protection compared to an unlocked one. Generally, the FP4 should probably not be considered a secure device; there’s probably a reasonable argument for asking that Google revoke SafetyNet certification for the stock OS.
Most modern computers do have something similar to a locked bootloader, in having something like Secure Boot. My Framework laptop, for example, is running ArchLinux, uses signed boot images, and is set to enforce Secure Boot. Setting this up was quite simple and well-documented. The difference is that, on many computers, verified boot processes generally work in ways that can be easily utilized by the user to increase security, while locked bootloaders on most devices, other than Google’s own, are set up by manufacturers, including Fairphone, in ways that harm users who want to run anything other than the manufacturer’s software.
Does anyone know if this a specific problem with LineageOS that will get rectified by the maintainer? Would another flavour like /e work as expected?