My country launched an identification app (https://mygov.be/) that does the same thing. I have no idea what they're trying to achieve. Security through obscurity? Trying to piss off power users?

I'm a developer and use adb and some dev settings daily. Annoying af to have to disable developer mode constantly.

It's fundamentally client-side security: the phone tells the server "no, I haven't been rooted" and the server believes it.

Any security system that relies on any form of client-side security is going to have other problems as well, since its designers haven't grasped this basic principle.

That used to be a core principle but might not be guaranteed anymore. Depending on the implementation it can be near impossible to bypass modern hardware backed security. As it should be!

The policy issue at this point is that users effectively aren't in control of their devices anymore.

I had to turn on developer mode just to reduce blur in Android 16. It's incredible that's locked behind a developer mode setting.

> It will not work either if you have developer mode enabled.

Many other banking apps in Singapore have this ridiculous restriction too, including Citibank.

The third-party "security framework" most of them use to pass audits is ridiculous.