Yeah but lots of phones you can't get ROMs for from a reputable source, and I sure as heck don't have the know how or time to build one, even if possible, which a lot of times is not due to locking down bootloaders, drivers, etc.
When you buy a Windows PC, the first thing a lot of tech people will do is format it and put on a clean install of Windows without all of the OEM crapware, or in these days install Linux if grandma is just using email and Facebook anyway.
If you try to do that on your Android device, your bank app is broken, most importantly not because of anything the alternate OS is doing wrong, which causes the vast majority of people to not want to do it even if it means suffering the OEM crapware, with no way for the alternative OS to fix it. And that in turn allows the OEMs to get away with locked bootloaders etc., because then they're not losing sales to a competitor that lets you remove the crapware when nobody can do it either way.
The thing is they are the best e-scooters provider in town. They have fantastic support, few times agreed to my feature requests. They have very forgiving policy for when you forgot to lock the scooter and so on. I really believe that if I messaged them off season (when they work on the app, like now in winter), and suggested changing the way they attest phones, they would consider using the attestation that GOS can pass.
I think you're not asking for enough here. A scooter rental app does not need to attest phones. It doesn't even have a bad excuse for wanting to attest phones since payment information is surely stored server-side and it would be surprising if the scooters didn't have their own network connections and GPS trackers.
They kind of do - you can have bad actors messing with scooters. Myself I used GPS spoofer once to park out of the allowed zone (just a few meters, for lulz).
There can be people messing with the system, and limiting the OSes that can access your network looks like low hanging fruit. Just like Riot (League of Legends) banned Linux users to "solve" botters. But like with botters, there are better alternatives that don't exclude legitimate users.
Most of the larger scooter companies don't do it, so it seems unlikely operating such a system requires trying to get around the first rule of network security.
I feel like we (that is anyone nerdy enough to post on HN) have been far too patient with people who are choosing to wage a war on general-purpose computing, and it's past time to push back harder.
Years ago I used to love playing around with roms on my phone on XDA and it worked OK. I don't know what folks use these days. But as recently as a few years ago I merely rooted my phone and I couldn't use a lot of apps, not just banking, but even some games.
There are tools to make your device appear to every app as running in a non-rooted environment. Here[1] is a tutorial on how to bypass Google/Samsung Wallet detections. There are threads for different apps and it will quickly turn into a cat and mouse play when Playstore app itself updates, but as the phone is rooted, someone will continue to find a way to bypass attestations and will post a comment on Reddit or XDA explaining how to do it.
