App thinks phone is rooted

Plethora9278

Hi all
AGOV replied to my support request as follows:

_Unsere Nachforschungen haben ergeben, dass das Betriebssystem auf Ihrem Smartphone (GrapheneOS) derzeit nicht den von der App geforderten Sicherheitsstandards entspricht.

Die Access-App prüft das Betriebssystem auf Vertrauenswürdigkeit und verwendet dazu eigene Algorithmen, die nicht offengelegt werden. Mit anderen Worten: Wenn die App entscheidet, auf Ihrem Smartphone nicht zu funktionieren, gibt es für den Benutzer keine Möglichkeit, dies zu umgehen. Sie müssen einen anderen Loginfaktor registrieren (z. B. ein anderes Smartphone, ein Tablet oder einen FIDO-Key).

Wenn Sie AGOV weiterhin nutzen möchten, stehen Ihnen folgende Alternativen zur Verfügung:

Ein Tablet oder Smartphone mit iOS oder einem zugelassenen Android-Betriebssystem
Ein Sicherheitsschlüssel, z. B. https://agov.token2.ch/
Link zur Liste der unterstützten Sicherheitsschlüssel: Sicherheitsschlüssel
Nicht unterstützt: Ein Windows 11 Computer/Laptop mit Windows Hello (hardwarebasiert)

Wir bedauern die eingeschränkten Möglichkeiten und hoffen dennoch, dass Sie eine für Sie gangbare Lösung finden._

No reference nor indication that they're working on solving this issue. Can we get an update here from @dkn eventually? Thanks!

shiaido

The same problem occurs with Austrias Government-App "ID-Austria". Neither Step1 nor Step2 helps, the app is always "detecting" root. I am using Yubikey because of this.

Drimagon

shiaido
ID-Austria is running on my device (P9 Pro) without any issues. I don't need to enable Exploit Protection.
Installed it through owner and pushed it to secondary user without GPS.

It worked even with the old app but it detected the false positive root. But you could just "accept the risk".

shiaido

Drimagon
Thanks to your answer I tried again and reinstalled it. It detects root again, but now there was the Button "auf eigene Gefahr fortfahren" = "Proceed at your own risk" and registration was possible.
Thank you!

fischermatte

@dkn I think the root detection is not only not working for graphene os. My partner has a oneplus 6 with android 11, no root but still detects it. Is the dev team aware? Looking at the comments on play store, quite some people are annoyed. While it was working last year, they can not use it this year anymore for filling out taxes.

Plethora9278

This is the closing reply from BIT (Bundesamt für Informatik und Telekommunikation):

Zurzeit ist GrapheneOS für die AGOV access App noch nicht zugelassen.
Die Schweizerische Bundeskanzlei hat dem Lieferanten die Freischaltung von GrapheneOS in Auftrag gegeben. Es konnte noch kein Lieferdatum festgelegt werden.

2.9 Wird GraphaneOS von der AGOV access App unterstützt?
https://www.agov.admin.ch/de/fragen-und-antworten_

Wir empfehlen daher alternativ auf einen physischen FIDO Token auszuweichen oder auf ein unterstütztes Gerät gem. FAQ 1.7

Eine Liste an offiziell unterstützten Sicherheitsschlüsseln finden Sie unter https://www.agov.admin.ch/de/sicherheitsschluessel_

Joe22graph

Thank you! For me the workaround of temporarily disabling Secure app spawning for the few times that I need the AGOV access app works fine.

Plethora9278

Joe22graph Can you explain how this workaround goes?

Joe22graph

Sure - after installing AGOV access app I went to Settings - Security & Privacy - Exploit protection - Secure app spawing (at the bottom, last item), which is enabled by default, and toggle "Use secure app spawning" to disabled. Then confirm the required Restart.
AGOV access app is running fine now, no error messages. Hope this works for you too (I am on a Pixel 6a)

Plethora9278

Joe22graph Thanks for the details. I'll try it after filing the taxes for 2025 - don't want to get stuck in not having the AGOV app working neither on my old, nor on my new phone!

mademoisellemabry

Using AGOV on my new Pixel 9a (and new to GOS as well), I'm running into the following problem: I can disable secure app spawning to make AGOV work, embed my account, verify etc., but then I enable secure app spawning again (because it's better having it activated and you don't need AGOV very often) and when I want to use AGOV at a later point and therefore disable secure app spawning again, all my accounts in AGOV are gone and I have to start over. Means to me, that I need a 2nd device that let's me use AGOV reliably - or: you need to disable secure app spawning contstantly or otherwise you're not really able to use AGOV with GOS.
Can someone confirm?

Plethora9278

mademoisellemabry I think there's nothing else that can be done, you described the 2 possible options.

mademoisellemabry

I issued a new support ticket with AGOV to see if they have a release date. Will post any news here.

In my case, I still have my old Fairphone 3 with Standard Google and AGOV, but as software support for Android 13 is ending I think AGOV will stop working at some point rather sooner than later.

Come December, the new Suisse E-ID should become available and will have its own wallet app, "swiyu" (see https://www.agov.admin.ch/de/agov-mit-eid). I hope they build it GOS compatible out of the box... Any thoughts on that development?

Plethora9278

mademoisellemabry I think it's already enough data our government(s) possess, that I'm not really keen to get an E-ID... Just pushing to have AGOV and other apps run on GOS is the way to go in any case. Same stupidity is affecting UBS customers... UBS claims that GOS is not secure!!!

mademoisellemabry

mademoisellemabry
Got a reply today from the Swiss federal office responsible for AGOV (Bundeskanzlei BK / Digitale Transformation und IKT-Lenkung DTI):

Leider liegt uns aktuell noch kein definitiver Termin vor. Wir arbeiten weiterhin aktiv daran und gehen davon aus, dass der Termin voraussichtlich im Q3, spätestens anfangs Q4 dieses Jahres erfolgen wird.
Wir möchten Sie zudem um etwas Geduld und Verständnis bitten. Wir stehen in engem Austausch mit unserem Partner, sind uns der Situation bewusst und setzen alles daran, möglichst bald ein Ergebnis zu erzielen.

So they can't confirm but hope to release a version supporting GOS in Q3 or at the start of Q4 at the latest.

Regarding the Swiss ID app swiyu, they directed me to the following discussion: https://github.com/orgs/swiyu-admin-ch/discussions/53#discussion-9237023
I'm not an expert therefore a bit unsure what to read out of it. For now, the beta app is running just fine on GOS...

Plethora9278

Today a new AGOV version has been released... but sadly it still thinks my Pixel 9a running GOS is rooted :-(
I might hit them up again to ask about an ETA...

Drue3

Plethora9278 Best case will be Q3 or Q4. worst case, later. As announced in the comment above yours.

HappyPanda67

Newbie here. "disable secure app spawning, reboot your phone", I don't really understand what that does and I'm a bit worried by: " I can disable secure app spawning to make AGOV work, embed my account, verify etc., but then I enable secure app spawning again (because it's better having it activated and you don't need AGOV very often) and when I want to use AGOV at a later point and therefore disable secure app spawning again, all my accounts in AGOV are gone and I have to start over."

I'm wondering, if I could install agov alone in a separate profile and let this "secure app spawning" disabled (it would be disabled only for one account, right?), so I don't run in the problem where all my AGOV accounts are gone... But as I don't really understand from what the secure app spawning protects (I tried to find some explanaitions about it but it's way above my head...), I can't tell if it's a good idea.

Would someone gentle help me to understand?

Carrousel7956

HappyPanda67 It's fine, don't worry about it.

dorg

Confirm it works to me, installed as per this report https://github.com/PrivSec-dev/banking-apps-compat-report/issues/856

Joe22graph

I added a new user profile and took a while to notice that Secure app spawning was disabled for the app by default (missing option under Settings-Security) in the new profile. Seems, though, that needs to be disabled system-wide otherwise my device is not supported (SDK-rooted device) (Android 17, Pixel 6a). So at present exist only the two options described above on 24 Apr - is that correct or am I missing something?

mademoisellemabry

Joe22graph Seems to be the status quo as of today, yes.

« Previous Page Next Page »