5 ms·

I just saw this yesterday about losing Authy for 2FA on non-official Android devices w/o play services. I'm curious how phones like this are handling that. htt

• fsflover 2y ago
  You can run Android apps with Waydroid, but you can't overcome the DRM. You have to complain that you run an alternative OS, which has a right to exist.
  • pogue 2y ago
    So you can still access 2FA through non-official Android builds.... or no?
    • fsflover 2y ago
      Yes, unless these apps require the "safety"-net.
      • usernameks 2y ago
        Even worse: (Google) play integrity.
• kmeisthax 2y ago
  Google isn't banning hardware killswitches in their compatibility definition, so a phone with such switches can still ship Play Services. The main stumbling block here is that Google wants to tie users' hands in certain aspects, and many of these OSes are specifically designed to undo that control. GrapheneOS does a bunch of stuff to improve security that absolutely could be incorporated into a Play Integrity authorized build. But it also does a bunch of stuff in the name of user privacy that Google would never sign off on. For example, there are apps[1] that refuse to work without a GPS lock, for a variety of reasons ranging from "I save money on streaming rights by only letting you watch in a specific country" to "I need to know if you're a criminal trying to stuff our banking app with stolen credentials in a foreign country we can't prosecute you in". Some of these reasons are pro-user, some are user-hostile[0], but all of them require handcuffing the user, so Android cooperates with app developers instead of you. All the permitted ways for a user to manipulate their location are transparent to the application. That is, if you mock your location, the application is told it's fake and can refuse it. Likewise, if you turn off location, the application is told it didn't get a fix. Hardware killswitches are just a more powerful / legible way to turn off location. If the phone instead had a hardware GPS signal spoofer in it, Google would absolutely ban it from Play Integrity. [0] And, for the user-hostile reasons, those are the terms of sale, so Google cooperating with the user would just get the app taken away because the entertainment conglomerates are big enough to oppose Google's market power. [1] Client and server inclusive, i.e. "an app is just a website with enough IP to make it a felony to block ads in it". Play Integrity exists specifically to frustrate attempts to modify the client. If you modify the client or the OS it lives in, Play Integrity's signed data will have the wrong hashes in them, and the server will refuse service to you.
  • NotPractical 2y ago
    > But it also does a bunch of stuff in the name of user privacy that Google would never sign off on. I don't think that's necessarily true. It's actually kind of confusing to me that Google doesn't whitelist GrapheneOS. According to their website [1]: > GrapheneOS not only upholds the app security model but substantially reinforces it, so it cannot be justified with reasoning based on security, anti-fraud, etc. Ever since I discovered this article, as a GrapheneOS user, I've felt sort of conflicted about it. On one hand, it would be good to see more apps support GrapheneOS. On the other hand, as a FOSS advocate, it irks me that I can't make arbitrary changes to my OS without taking the risk that certain apps might stop working for no reason [2]. It also places GrapheneOS in a bit of an awkward position as a open source project, where it's possible that they might be forced not to include certain features because they made this promise to banking apps. For example, they would probably not accept a location spoofing feature that can't be detected by app developers, because banking apps could no longer trust the OS-provided APIs. But again on the other hand, this policy means it's not off the table that Google might whitelist GrapheneOS in Play Integrity one day, which I think would be a good thing (of course there's business interests at play here, but there's no valid non-business reason for them not to). Overall, the entire mobile phone ecosystem depresses me. I just try to avoid using my phone as much as possible, and keep the number of installed apps to a minimum. I'll probably give the iPhone a try if they ever start allowing sideloading (wishful thinking). Unfortunately it seems like it may become unsustainable to avoid placing full trust in your phone's manufacturer, and I'd only be comfortable giving that to Apple, not Google or Samsung. [1] https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu... [2] It should be noted that, as of today, I don't think any banking app has added explicit compatibility for GrapheneOS. AFAIK all the banking apps that work with GrapheneOS also work with any (non-rooted) open-source Android alternative. As a sidenote, I currently work around this issue entirely by simply using my bank's website instead of their silly app, and this will continue to work as long as hackers continue to fight against Google's dystopian plan for the web: https://en.wikipedia.org/wiki/Web_Environment_Integrity https://en.wikipedia.org/wiki/Web_Environment_Integrity
    • t0bia_s 2y ago