5 ms·

GrapheneOS may take legal action against Google regarding Play Integrity API

82 points by udev4096 2y ago

olliej 2y ago
Actual link: https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-tool-puts-security-minded-grapheneos-in-a-paradox/ https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-...
- TSUTiger 2y ago
  Off twitter/x you miss the tweet quoted reply[1]: The article unfortunately leaves out most of the points we made in the thread. GrapheneOS supports hardware-based attestation and it's entirely possible for Google to allow it as part of the Play Integrity API. They choose to ban using GrapheneOS. [1]: https://nitter.privacydev.net/GrapheneOS/status/1818415391791570995 https://nitter.privacydev.net/GrapheneOS/status/181841539179...
  - thrtythreeforty 2y ago
    As a baseline for discussion, I agree that GrapheneOS is far more secure than stock Android (fantastic Cellebrite citation, by the way). I'm not attacking your assertion that Google is misusing Play Integrity anticompetitively, which you make a plausible case for. But hardware-based attestation is fundamentally based on a whitelist of OS images. With AVB, the only job of hardware is to validate that the chain of trust starts with the certificate the user provides (or the factory default). That certificate, if controlled by a trusted party, attests that the resulting chain of trust implements the Android security model correctly. But all the Android API does is provide a verifiable attestation of what is running; it can't attest that Android hasn't been e.g. Magisk'd and then re-signed. (Please correct me if I'm wrong here!) Google trusts themselves, of course, perhaps too much. But, they're unwilling to add others to the whitelist of things they trust. I think what you're asking for, is actually for the Play Integrity code to have some mechanism to become trusted/whitelisted (this would prevent other app devs from having to play whack-a-mole to allow other secure images). Phrasing it that way might be a good clarification.
    - TheCoelacanth 2y ago
      They don't seem to have an issue with trusting other phone manufacturers, many of whom have a very half-assed attitude towards security. Why would they have an issue with trusting the single most security-conscious Android OS producer other than preventing competition?
  - olliej 2y ago
    I don’t use twitter, so I - and anyone else who does not use twitter - only see a link to ars. It’s literally just a link to a link. If there’s more information, that information should be on a public site (maybe the grapheneos website?)
dtx1 2y ago
[flagged]
gruez 2y ago
This nitter instance gives me a 403 error but here's the original x.com link: https://x.com/GrapheneOS/status/1818415391791570995 https://x.com/GrapheneOS/status/1818415391791570995 as well as an alternate mirror https://nitter.privacydev.net/GrapheneOS/status/1818415391791570995 https://nitter.privacydev.net/GrapheneOS/status/181841539179...
- denysvitali 2y ago
  https://archive.ph/OUry5 https://archive.ph/OUry5
- LargoLasskhyfv 2y ago
  xcancel.com usually works reliably.
jeffbee 2y ago
What is the perspective of the authors of Authy here? If they want the integrity API to limit their app to official builds, then it is working as intended by them and presumably by the users who freely choose Authy over other apps. I am not sure why Graphene has standing here.
- unethical_ban 2y ago
  1. According to the article, graphene says that the play integrity API doesn't do what it is advertised to do, so arguing that it is a security mechanism is false. 2. Speculation: They could argue that apps should not be allowed to lock out alternative OSes, but only alert users of "reduced security". 3. I'm glad I left authy for Proton.
  - zb3 2y ago
    But there could be no "reduced security", even for apps. It's just that there's no Google spyware installed on the device with elevated permissions, that's why Google won't approve GrapheneOS.
    - unethical_ban 2y ago
      The whole thing is about trust. Google, Apple and MS are setting themselves up as authorities of trust for hardware. Authy took the stance that if an OS vendor doesn't sign the bootloader/OS, then it is possible the OS is compromised and other apps could maliciously interact with Authy. I don't like where that takes us from a computing freedom perspective.
- Fire-Dragon-DoL 2y ago
  The reason is that there is no open source os that can be verified with the play integrity api. Forget authy, you cannot run netflix or most banking apps. That's effectively discrimination for people who don't want to be tracked or people who don't want to give money to google. Given Google has a monopoly, this is pretty heavy.
freedomben 2y ago
> Play Integrity API is based on lies. Fantastic line. I imagine I'm trying to escape from Google HQ while GLaDOS makes me test repeatedly, and through a crack in the wall in a storage area I see scrawled in charcoal and blood: "Play Integrity API is based on lies."
- jeroenhd 2y ago
  It's such a shame, too. The principle is sound, the feature is clearly wanted by security-conscious apps, but Google can't make an integrity API that a vast amount of their partners' existing customers won't pass. Something as simple as "has received a security update the past 12 months" seems like an basic requirement for fraud prevention and DRM, but doing so will kick millions of people out of common apps and make their API pretty useless while also pissing off their partners. Instead, we get this vague "does the user run a custom ROM that didn't put effort into not being detected" API that serves no purpose. From a user perspective, GrapheneOS is a better partner for Google to work with than so many manufacturers. The amount of straight-up spyware and API-noncompliance I've seen from super cheap phones that somehow managed to pass Google's inspection makes the entire certification process a joke. Meanwhile, Graphene manages to protect its users against exploits better than even Google can. Perhaps it's time for someone to write an app that spoofs the Play Integrity API not by pretending to only support software integrity, like many workarounds do, but by using the leaked manufacturer certificates to fake hardware signatures for any device, forcing Google to choose between redesigning the API or banning their partners' unrelated devices (that, let's be realistic, probably haven't received an update for their key store). Getting one of these leaked keys is probably not easy, but I'm sure _someone_ in the Android modding scene has managed to get their hands on it. I do wonder what Google's response will be once Graphene does indeed stop taking part in the bug bounty program and a serious exploit hits Google's devices because of code pushed to the Graphene source tree. If I were malicious, I'd start watching the GrapheneOS patches very closely now that they've indicated they're no longer reporting security bugs upstream. They've found several serious vulnerabilities in the past, and are probably one of the few projects that actually inspects and cares about Android's security mechanisms (Google's partners sure don't seem to), so I'm sure they'll find serious security flaws before Google changes its mind.
Fire-Dragon-DoL 2y ago
I was reviewing the Android world, apparently if you want updates you either pick google, samsung or lineageos or grapheneos (still google). Now, if you pick the first 2,you get tracking. if you pick the other two, you are banned from various apps and functionality even if the phone is not rooted because "there is no megacorp backing you up". This is really, really bad. Equivalent to the linux secureboot issue that could have been.
- yjftsjthsd-h 2y ago
  > I was reviewing the Android world, apparently if you want updates you either pick google, samsung or lineageos or grapheneos (still google). What do you mean? Plenty of ROMs get regular updates on a variety of hardware.
  - Fire-Dragon-DoL 2y ago
    Yes, sorry I should have specified, they are all affected by the same problem though: no hardware attestation
- udev4096 2y ago
  It's certainly not the case with GrapheneOS. I have hardly faced any issues with the apps that I use. And if it's complaining about not having play services, you can install sandboxed play services on a new profile
  - TheCoelacanth 2y ago
    Most apps work fine, but certain cases like NFC payments generally don't because those apps require that you are using an OS that is signed by someone on their allow-list.
  - solarkraft 2y ago
    Even with the maximum of proprietary services I just about got reliable location sensing while outside. Still much worse than on iOS/stock Android. Banking did work however, kudos for that.
deleted 2y ago
[deleted]
c0l0 2y ago
"Play Integrity" is not there for your, the user's, security. It's there for the app makers' security and guaranteed control, so that they can force you, the user, to endure their every whim and their applications' every shit dark pattern and user-hostile behavior. It is there to make all that unmitigable. If any regulator were to put an end to all that, I'd be all for it.
- AshamedCaptain 2y ago
  Go tell that to all those people who defend Apple's walled garden and/or Secure Boot-like crap.
- zb3 2y ago
  It's not even for the app makers.. it's actually for Google to ensure their spyware is installed on the device with elevated permissions.
ChrisArchitect 2y ago
[dupe] Actual article link: https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-tool-puts-security-minded-grapheneos-in-a-paradox/ https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-... (https://news.ycombinator.com/item?id=41114531 https://news.ycombinator.com/item?id=41114531)
zb3 2y ago
Users should support the lawsuit. GrapheneOS is not "less secure", it's just that it doesn't give Google preinstalled privileged unremovable spyware present on the device. "Integrity API" doesn't really check the security model, it checks whether the Google privileged spyware is installed on the device.
udev4096 2y ago
The mods changed the links, again (WHY?). The replaced link does no justice to the actual topic being discussed here. Here's the original tweet which I posted: https://nitter.poast.org/GrapheneOS/status/1818415391791570995#m https://nitter.poast.org/GrapheneOS/status/18184153917915709...
denysvitali 2y ago
https://archive.ph/OUry5 https://archive.ph/OUry5
camilla4151 2y ago
[flagged]
camilla4151 2y ago
[flagged]
sliken 2y ago
Sounds like Graphene OS is going to lose authy and anything else that uses the Google Integrity API. Recommendations for a similar 2FA app that does not use the Google Integrity API?

82 points by udev4096 2y ago

Actual link: https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-tool-puts-security-minded-grapheneos-in-a-paradox/ https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-...

TSUTiger 2y ago
Off twitter/x you miss the tweet quoted reply[1]: The article unfortunately leaves out most of the points we made in the thread. GrapheneOS supports hardware-based attestation and it's entirely possible for Google to allow it as part of the Play Integrity API. They choose to ban using GrapheneOS. [1]: https://nitter.privacydev.net/GrapheneOS/status/1818415391791570995 https://nitter.privacydev.net/GrapheneOS/status/181841539179...
- thrtythreeforty 2y ago
  As a baseline for discussion, I agree that GrapheneOS is far more secure than stock Android (fantastic Cellebrite citation, by the way). I'm not attacking your assertion that Google is misusing Play Integrity anticompetitively, which you make a plausible case for. But hardware-based attestation is fundamentally based on a whitelist of OS images. With AVB, the only job of hardware is to validate that the chain of trust starts with the certificate the user provides (or the factory default). That certificate, if controlled by a trusted party, attests that the resulting chain of trust implements the Android security model correctly. But all the Android API does is provide a verifiable attestation of what is running; it can't attest that Android hasn't been e.g. Magisk'd and then re-signed. (Please correct me if I'm wrong here!) Google trusts themselves, of course, perhaps too much. But, they're unwilling to add others to the whitelist of things they trust. I think what you're asking for, is actually for the Play Integrity code to have some mechanism to become trusted/whitelisted (this would prevent other app devs from having to play whack-a-mole to allow other secure images). Phrasing it that way might be a good clarification.
  - TheCoelacanth 2y ago
    They don't seem to have an issue with trusting other phone manufacturers, many of whom have a very half-assed attitude towards security. Why would they have an issue with trusting the single most security-conscious Android OS producer other than preventing competition?
- olliej 2y ago
  I don’t use twitter, so I - and anyone else who does not use twitter - only see a link to ars. It’s literally just a link to a link. If there’s more information, that information should be on a public site (maybe the grapheneos website?)

dtx1 2y ago

[flagged]

gruez 2y ago

This nitter instance gives me a 403 error but here's the original x.com link: https://x.com/GrapheneOS/status/1818415391791570995 https://x.com/GrapheneOS/status/1818415391791570995 as well as an alternate mirror https://nitter.privacydev.net/GrapheneOS/status/1818415391791570995 https://nitter.privacydev.net/GrapheneOS/status/181841539179...

denysvitali 2y ago
https://archive.ph/OUry5 https://archive.ph/OUry5
LargoLasskhyfv 2y ago
xcancel.com usually works reliably.

jeffbee 2y ago

What is the perspective of the authors of Authy here? If they want the integrity API to limit their app to official builds, then it is working as intended by them and presumably by the users who freely choose Authy over other apps. I am not sure why Graphene has standing here.

unethical_ban 2y ago
1. According to the article, graphene says that the play integrity API doesn't do what it is advertised to do, so arguing that it is a security mechanism is false. 2. Speculation: They could argue that apps should not be allowed to lock out alternative OSes, but only alert users of "reduced security". 3. I'm glad I left authy for Proton.
- zb3 2y ago
  But there could be no "reduced security", even for apps. It's just that there's no Google spyware installed on the device with elevated permissions, that's why Google won't approve GrapheneOS.
  - unethical_ban 2y ago
    The whole thing is about trust. Google, Apple and MS are setting themselves up as authorities of trust for hardware. Authy took the stance that if an OS vendor doesn't sign the bootloader/OS, then it is possible the OS is compromised and other apps could maliciously interact with Authy. I don't like where that takes us from a computing freedom perspective.
Fire-Dragon-DoL 2y ago
The reason is that there is no open source os that can be verified with the play integrity api. Forget authy, you cannot run netflix or most banking apps. That's effectively discrimination for people who don't want to be tracked or people who don't want to give money to google. Given Google has a monopoly, this is pretty heavy.

freedomben 2y ago

> Play Integrity API is based on lies. Fantastic line. I imagine I'm trying to escape from Google HQ while GLaDOS makes me test repeatedly, and through a crack in the wall in a storage area I see scrawled in charcoal and blood: "Play Integrity API is based on lies."

jeroenhd 2y ago
It's such a shame, too. The principle is sound, the feature is clearly wanted by security-conscious apps, but Google can't make an integrity API that a vast amount of their partners' existing customers won't pass. Something as simple as "has received a security update the past 12 months" seems like an basic requirement for fraud prevention and DRM, but doing so will kick millions of people out of common apps and make their API pretty useless while also pissing off their partners. Instead, we get this vague "does the user run a custom ROM that didn't put effort into not being detected" API that serves no purpose. From a user perspective, GrapheneOS is a better partner for Google to work with than so many manufacturers. The amount of straight-up spyware and API-noncompliance I've seen from super cheap phones that somehow managed to pass Google's inspection makes the entire certification process a joke. Meanwhile, Graphene manages to protect its users against exploits better than even Google can. Perhaps it's time for someone to write an app that spoofs the Play Integrity API not by pretending to only support software integrity, like many workarounds do, but by using the leaked manufacturer certificates to fake hardware signatures for any device, forcing Google to choose between redesigning the API or banning their partners' unrelated devices (that, let's be realistic, probably haven't received an update for their key store). Getting one of these leaked keys is probably not easy, but I'm sure _someone_ in the Android modding scene has managed to get their hands on it. I do wonder what Google's response will be once Graphene does indeed stop taking part in the bug bounty program and a serious exploit hits Google's devices because of code pushed to the Graphene source tree. If I were malicious, I'd start watching the GrapheneOS patches very closely now that they've indicated they're no longer reporting security bugs upstream. They've found several serious vulnerabilities in the past, and are probably one of the few projects that actually inspects and cares about Android's security mechanisms (Google's partners sure don't seem to), so I'm sure they'll find serious security flaws before Google changes its mind.

Fire-Dragon-DoL 2y ago

I was reviewing the Android world, apparently if you want updates you either pick google, samsung or lineageos or grapheneos (still google). Now, if you pick the first 2,you get tracking. if you pick the other two, you are banned from various apps and functionality even if the phone is not rooted because "there is no megacorp backing you up". This is really, really bad. Equivalent to the linux secureboot issue that could have been.

yjftsjthsd-h 2y ago
> I was reviewing the Android world, apparently if you want updates you either pick google, samsung or lineageos or grapheneos (still google). What do you mean? Plenty of ROMs get regular updates on a variety of hardware.
- Fire-Dragon-DoL 2y ago
  Yes, sorry I should have specified, they are all affected by the same problem though: no hardware attestation
udev4096 2y ago
It's certainly not the case with GrapheneOS. I have hardly faced any issues with the apps that I use. And if it's complaining about not having play services, you can install sandboxed play services on a new profile
- TheCoelacanth 2y ago
  Most apps work fine, but certain cases like NFC payments generally don't because those apps require that you are using an OS that is signed by someone on their allow-list.
- solarkraft 2y ago
  Even with the maximum of proprietary services I just about got reliable location sensing while outside. Still much worse than on iOS/stock Android. Banking did work however, kudos for that.

deleted 2y ago

[deleted]

c0l0 2y ago

"Play Integrity" is not there for your, the user's, security. It's there for the app makers' security and guaranteed control, so that they can force you, the user, to endure their every whim and their applications' every shit dark pattern and user-hostile behavior. It is there to make all that unmitigable. If any regulator were to put an end to all that, I'd be all for it.

AshamedCaptain 2y ago
Go tell that to all those people who defend Apple's walled garden and/or Secure Boot-like crap.
zb3 2y ago
It's not even for the app makers.. it's actually for Google to ensure their spyware is installed on the device with elevated permissions.

ChrisArchitect 2y ago

[dupe] Actual article link: https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-tool-puts-security-minded-grapheneos-in-a-paradox/ https://arstechnica.com/gadgets/2024/07/loss-of-popular-2fa-... (https://news.ycombinator.com/item?id=41114531 https://news.ycombinator.com/item?id=41114531)

zb3 2y ago

Users should support the lawsuit. GrapheneOS is not "less secure", it's just that it doesn't give Google preinstalled privileged unremovable spyware present on the device. "Integrity API" doesn't really check the security model, it checks whether the Google privileged spyware is installed on the device.

udev4096 2y ago

The mods changed the links, again (WHY?). The replaced link does no justice to the actual topic being discussed here. Here's the original tweet which I posted: https://nitter.poast.org/GrapheneOS/status/1818415391791570995#m https://nitter.poast.org/GrapheneOS/status/18184153917915709...

denysvitali 2y ago

https://archive.ph/OUry5 https://archive.ph/OUry5

camilla4151 2y ago

[flagged]

camilla4151 2y ago

[flagged]

sliken 2y ago

Sounds like Graphene OS is going to lose authy and anything else that uses the Google Integrity API. Recommendations for a similar 2FA app that does not use the Google Integrity API?