Magisk will fail Safety-Net hereafter. Why? Recently, Google made security changes which make sure safety-net fails check when Magisk is installed.

This was Tweeted by John Wu (Magisk developer) , here and here. Some excerpts:


  So here we go, after years of fun messing around using Magisk, it seems that Google FINALLY decided to "fix" SafetyNet to something useful, and that is to use key attestation to verify device status (after 3 years since introduced to Android's platform!)
  
  Let's face it. Fun is over guys.


(Emphasis added) 

Edit: From Github 


  Disable MagiskHide by default
  
  Since SafetyNet CTS is impossible to achieve, leaving MagiskHide on
  by default no longer serves a purpose.
  
  For more details regarding the latest SafetyNet changes, please check:
  https://twitter.com/topjohnwu/status/1237656703929180160
  https://twitter.com/topjohnwu/status/1237830555523149824
  
  MagiskHide's functionality will continue to exist within the Magisk
  project as it is still extremely effective to hide modifications in
  userspace (including SafetyNet's basicIntegrity check).
  
  Future MagiskHide improvements may come, but since the holy grail
  has been taken, any form of improvement is now a very low priority


It looks to me that Google could/should have implemented this earlier but didn't and the CTS check being done from within Magisk wasn't comprehensive. 

Please demystify this in simple terms (to the extent possible) for folks who don't understand the innards of Android (like me).
John Wu (Magisk Developer) posted updates today, which clarifies the reasons.
Earlier, SafetyNet API wasn't fully / correctly implemented, the way it was meant to be :

Key Attestation


From what we've seen so far, key attestation doesn't seem to be fully enforced yet, as devices with incompatible, potentially buggy(?) keymaster implementations (e.g. some OnePlus devices) that result in attest key cmd failures still pass SafetyNet regardless.


Attestation was done locally


bootloader reports the device status via kernel cmdlines, and init will reflect them in properties, and apparently SafetyNet was using those values. All those stuff is in userspace, so Magisk can simply manipulate it

Now, with the Feature Preview: SafetyNet Attestation API evaluationType, there will be two types of evaluation, BASIC and HARDWARE_BACKED for a complete evaluation with remote validation (as against local) :

HARDWARE_BACKED - When we use the available hardware-backed security features of the remote device (e.g. hardware-backed key attestation) to influence our evaluation.


We’re currently evaluating and adjusting the eligibility criteria for devices where we will rely on hardware-backed security features.

Can this new system be hacked?
Looks very unlikely

Even if we force validation to use BASIC method, it won't be hidden


IMO it is theoretically possible to alter control flow in SafetyNet's code to force it to always use BASIC evaluation by using some hooking framework like Xposed, however these kind of code injection is basically impossible to hide (memory space analysis).


HARDWARE_BACKED is serious stuff and unlikely to be cracked since it involves TEE or hardware changes leading to cryptographic compromise (Robert also pointed out in comments)


To hack this thing, you have to either find a vulnerability in TEE firmware (which will be patched ASAP once found) or hardware (less likely to happen) to break the cryptography.


Breaking TEE won't be easy, which is why many security researchers are actively working on it.

(Emphasis added in all quotes)
How to check if Google has implemented hardware Attestation for my device?
Edit Magisk canary has been updated to show evaluation status and once the API is implemented, you will see more details (failing SafetyNet). Or, follow instructions on this XDA post to check attestation method using logcat

For more information see SafetyNet's hardware attestation will make hiding root in Magisk really hard

Edited on 16 December 20
And the final nail in the coffin for  fooling safety net detection
Johnwu in

tweet says


HW based evaluation is impractical to &quot;hack&quot; (except tricks to make it fallback to basic), and I lost all interest in improving the current way of hiding.


Another tweet of 13 Dec 2020


If passing SafetyNet is the only use of Magisk for you, then yeah, bye Face with rolling eyes
( in response to So... magisk is completely useless right now?...)