3 ms·

DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but e

DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but explicitly tells users not to do that). It also has sandboxed implementations of both official Google services — ported from Graphene, I think – and microG. I'm using it with microG, bootloader relocked, and it seems to pass SafetyNet this way – at least the apps that didn't work on Lineage seem to work here. (I haven't yet tried Google Pay, though – I think it will require proper GApps.) https://divestos.org/ https://divestos.org/ Edit: by the way, banks requiring hardware attestation is probably a U.S. thing – in the EU and ex-USSR countries banks seem to not care about that at all (although some don't like it when you root your phone).

wkat4242 3y ago
Yeah US companies are weirdly strict on this. The McDonalds app won't even work if installed through the Aurora store, it has a custom screen that says it won't work if it wasn't installed through the play store :D Ridiculous. It doesn't even handle payments here in Europe, you still have to pay at the kiosk.
- notpushkin 3y ago
  Oh yeah you're right! McDonalds and Revolut are the only two apps that don't work on my phone no matter what I try. (Those and the phone-as-a-card-terminal apps, but that's totally reasonable.)
chenxiaolong 3y ago
> but explicitly tells users not to do that They set the vbmeta header flags field to 0x3, which effectively turns off all of AVB (Android Verified Boot). I'm guessing they do this because they want to allow the system partition to be writable (eg. for folks who flash additional things on top of LineageOS). With unmodified LineageOS, if you configured the bootloader to use LineageOS' public key and relocked it, there would be no security benefit. To enable AVB's signature checks, the flags field needs to be set to 0, which requires re-signing LineageOS with your own key.

wkat4242 3y ago

Yeah US companies are weirdly strict on this. The McDonalds app won't even work if installed through the Aurora store, it has a custom screen that says it won't work if it wasn't installed through the play store :D Ridiculous. It doesn't even handle payments here in Europe, you still have to pay at the kiosk.

notpushkin 3y ago
Oh yeah you're right! McDonalds and Revolut are the only two apps that don't work on my phone no matter what I try. (Those and the phone-as-a-card-terminal apps, but that's totally reasonable.)

chenxiaolong 3y ago

> but explicitly tells users not to do that They set the vbmeta header flags field to 0x3, which effectively turns off all of AVB (Android Verified Boot). I'm guessing they do this because they want to allow the system partition to be writable (eg. for folks who flash additional things on top of LineageOS). With unmodified LineageOS, if you configured the bootloader to use LineageOS' public key and relocked it, there would be no security benefit. To enable AVB's signature checks, the flags field needs to be set to 0, which requires re-signing LineageOS with your own key.