It'simple - many apps are NOT using SafetyNet but only looking for traces of Magisk specifically and clues -direct or indirect- of having an unlocked bootloader and having a custom recovery installed (*couhg-cough* having a TWRP dir in the internal storage.. *couhg-cough*), being rooted
somehow (looking for su binary, etc..), looking for traces of Xposed and modules and|or looking for suspicious props like whatever includes "lineage" will trigger the "
it's rooted!!!" alarm.
There are lots of apps doing the same as what most banking apps are doing (
RootBeerSample,
RootBeerFresh and the very-very thorough
VD Infos whose developer is the same guy developing
MagiskDetector (
release downloads) and
XPosedDetector (
release downloads)) but SafetyNet ctsProfile mismatch is not always a trigger for banking / sensitive apps, sometimes basicintegrity (like having an unlocked bootloader with Xiaomi.EU ROM installed..) means enough security for them if you have no more tampering (or at least you can hide it)..
Like an app I'm using for banking (
myRaiffeisen Hungary): even though SafetyNet ctsProfile fails but basicintegrity is okay the app do run on an unmodified, Magisk-less Xiaomi.EU ROM. If you install Magisk it will fail but it's quite interesting: you can hide Magisk app, you can pass SafetyNet and everything BUT until the hidden Magisk is installed and
visible it won't work and tell you that your device is rooted. BUT.. if you uninstall the hidden Magisk app IT WORKS.. if you install AirFrozen (needs root) and after setting up all root permission settings ((Magisk hide + root permissions to apps) + installing all modules) and go to
AirFrozen or
Ice Box and
freeze the hidden Magisk app ("adb shell pm disable-user --user 0 <hidden_magisk_app's_package_ID>") IT WORKS.. Installing the hidden Magisk app to
Island or
Shelter does the trick, too. I ended up using AirFrozen, so whenever I want to check or do something in Magisk app I go to AirFrozen, activate the hidden Magisk app, do what I want in Magisk app, go back to AirFrozen and freeze the hidden Magisk app, again. Not that complex nor complicated yet convenient, no need to install-deinstall-reinstall Magisk app (all MagiskSU settings are stored in the /data/adb and the database anyway).
Oh, and sorry being offtopic.. but hope this helps some others.
..
