759
Revolut, McDonald's, and Authy have banned the use of GrapheneOS.
(grapheneos.org)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 09 Dec 2024
759 points (99.7% liked)
Privacy
32179 readers
162 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
the problem here is not the banks or apps, the problem is Google Play Integrity API, which is supposed to enforce to run apps in secured phones and it is used to ban secured ROMs such as GrapheneOS and it allows to run apps on outdated phones without security patches.
The point of the Google Play Integrity API is to ensure that the user is not in control of their phone, but that one of a small number of megacorps are in control.
Can the user pull their data out of apps? Not acceptable. Can the user access the app file itself? Not acceptable. Can the user modify apps? Not acceptable.
Basically it ensures that the user has no control over their own computing.
It's simply the "secure" isn't meant for users but the cooperations. Make it "secure" to their business.
It's used to help secure the businesses app yes. It helps with things like preventing resource abuse which would cost the company money. E.g. querying mass amounts of data on a loop to increase the companies bill.
If you install GrapheneOS, you do not need root, so GrapheneOS is in control of the phone not the user. The key here is if GrapheneOS is secure enough to be certified by Google Play Integrity API. is it security or other issue? perhaps Google is not supporter of FOSS ROMs, perhaps it is not fun of how GrapheneOS removes permissions to Google Apps, ...
If it is not security, this is a kind of monopoly to control which ROMs are allowed to run apps.
This is possible on any Android phone, no root or custom rom required
So that's why it works on lineage? They seem to get around this somehow
It runs in Lineage? Lineage is certified by Google Play Integrity API (I doubt it)? or Lineage tricks Google Play Integrity API?
Yes. These apps work and bank apps work fine. Netflix works too.
There are only problems with a bunch of applications that recently decided to use Play Integrity API not with every banking app nor Netflix.
This is the list: https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos
In fact those applications should not work with Lineage unless Play Integrity API is patched/cracked someway in Lineage.
Authy in that list works fine too
Oh, the banks and regulators are to blame. Especially in Europe.
Find me a PSD2 bank bank that doesn't require a phone number
In this case, thanks to regulation, it seems GrapheneOS team is talking with European Commission about this problem with Play Integrity API https://fosstodon.org/@GrapheneOS@grapheneos.social/113623767380032309 and the only hope is a movement of the regulator against this policy of Google.
So the Play Integrity API is literally why I moved to iOS. My bank apps didn't work with Lineage and the stock OnePlus ROM just sucked ass after the ColorOS or whatever update. I figured I might as well go iOS if I can't have a custom ROM anyway, and so far it has indeed been a much nicer experience than stock Android. If you can't TRULY customize everything, might as well at least get stability and consistency out of it, right? Plus at the time, there wasn't a single Android OEM out there with truly long OS update support.
Anyway, if this succeeds and custom ROMs are considered to have sound integrity, I might just move back to Android. Graphene seems cool, I haven't tried it yet because I've never owned a Pixel.
How would iOS be better? There is no blob-free, secure version on their devices at all. Right?
It's not for privacy. But without access to custom ROMs, Android is shit.
Sure, but the ROMs is what makes Android a more secure platform
Sure, but my point was if you can't even use ROMs because then you lose access to your bank (and now McD apparently), there's much less reason to use Android - certainly was so 2.5 years ago when they were mostly all promising 2-3 years of support for flagship devices and Apple had a track record of 6-7 years.
Nah, you dont need MacDonalds and you dont need shitty banks that require apps.
Apple has a terrible security record lol
How do I send people money without a bank? Okay maybe Wise but as you pointed out in the other thread, that money might not be insured. Also, iPhones are harder to unlock from before first unlock than many stock Androids.
I'm saying use another bank that doesn't block security hardened phones. Or one that doesn't require a phone at all.
More than half of the world sends money without bank accounts. How varies by region, but its usually a local company (usually mobile telecom companies) or an international remittances company, or cryptocurrencies
I personally use ATMs to send money. And if I were willing to resolve cert troubles (long story), I would've used the bank's website rather than the app.
I can't imagine using either of those solutions every day, sometimes several times per day.
I made 3 transfers yesterday, but there have been days of 10-20 transfers and I don't always have them planned, often it's pretty spontaneous when we buy used things from other people, particularly strangers.
Yeah, I transfer money not so regularly so I get why it wouldn't work for everyone. But why not use the website?
Website requires login every time, apps for most banks here have biometrics for transfers under a certain limit or people you send money to often.