5 ms·

I kinda understand it if a developer actually wants DRM. But why does my bank care to use it? I'm not likely to pirate my banking app.

notpushkin 2y ago
Because it says “security” and looks good on paper. For some inexplicable reason, many banks don’t seem to care about actual security, even the modern ones. (Shame on you, Revolut)
brookst 2y ago
Your bank loses money when keyloggers/etc are used. Play integrity claims to avoid this problem, and a rooted device with an alternative ROM is a big red flag. There are nuances here and there are probably ways app developers could support legit Graphene but not a malicious fork, but that’s a lot of work and expertise to reach an extra 0.01% of the population.
- protimewaster 2y ago
  I understand the idea, but GrapheneOS doesn't even provide any kind of official support for rooting. It's not that they're checking to see if the device is rooted, they're just checking to see if it has Google's checkmark. Meanwhile, rooted devices can pass Play Integrity (since they can spoof all the necessary bits via root).
  - brookst 2y ago
    Isn’t play integrity based on PKI and hardware root of trust? How does a rooted device fake the signed ROM / bootloader / etc?
    - protimewaster 2y ago
      I haven't read about it too much since I'm not rooted, but lots of users report being able to use apps that require integrity with various root approaches (e.g., https://www.reddit.com/r/Magisk/comments/19c1dv0/help_can_i_pass_the_playintegrity_strong/ https://www.reddit.com/r/Magisk/comments/19c1dv0/help_can_i_...)
- yjftsjthsd-h 2y ago
  > Your bank loses money when keyloggers/etc are used. Play integrity claims to avoid this problem, and a rooted device with an alternative ROM is a big red flag. Well... no? Maybe a device with things running as root is a yellow flag, but malware isn't going to replace the ROM or install a normal user-controlled root solution. Or put differently, if your "security" system flags the latest version of Lineage OS but doesn't flag a year-old stock ROM with known CVEs, then your system is actively fighting against security.
Retr0id 2y ago
You're not likely to pirate your own banking app, but thieves would love to patch the APK (or OS itself) so that it works "normally" except for skimming off credentials etc. in the background. This is functionally equivalent to what happens in app piracy (or game cheating, etc.), and all the same mechanisms are used to try to prevent it. I don't blame the banking apps, it makes sense given their incentives and constraints. But if Play Integrity existed to serve the user, it would answer only to the user, and not "snitch" the device integrity status to apps and their backends.

notpushkin 2y ago

Because it says “security” and looks good on paper. For some inexplicable reason, many banks don’t seem to care about actual security, even the modern ones. (Shame on you, Revolut)

brookst 2y ago

Your bank loses money when keyloggers/etc are used. Play integrity claims to avoid this problem, and a rooted device with an alternative ROM is a big red flag. There are nuances here and there are probably ways app developers could support legit Graphene but not a malicious fork, but that’s a lot of work and expertise to reach an extra 0.01% of the population.

protimewaster 2y ago
I understand the idea, but GrapheneOS doesn't even provide any kind of official support for rooting. It's not that they're checking to see if the device is rooted, they're just checking to see if it has Google's checkmark. Meanwhile, rooted devices can pass Play Integrity (since they can spoof all the necessary bits via root).
- brookst 2y ago
  Isn’t play integrity based on PKI and hardware root of trust? How does a rooted device fake the signed ROM / bootloader / etc?
  - protimewaster 2y ago
    I haven't read about it too much since I'm not rooted, but lots of users report being able to use apps that require integrity with various root approaches (e.g., https://www.reddit.com/r/Magisk/comments/19c1dv0/help_can_i_pass_the_playintegrity_strong/ https://www.reddit.com/r/Magisk/comments/19c1dv0/help_can_i_...)
yjftsjthsd-h 2y ago
> Your bank loses money when keyloggers/etc are used. Play integrity claims to avoid this problem, and a rooted device with an alternative ROM is a big red flag. Well... no? Maybe a device with things running as root is a yellow flag, but malware isn't going to replace the ROM or install a normal user-controlled root solution. Or put differently, if your "security" system flags the latest version of Lineage OS but doesn't flag a year-old stock ROM with known CVEs, then your system is actively fighting against security.

Retr0id 2y ago

You're not likely to pirate your own banking app, but thieves would love to patch the APK (or OS itself) so that it works "normally" except for skimming off credentials etc. in the background. This is functionally equivalent to what happens in app piracy (or game cheating, etc.), and all the same mechanisms are used to try to prevent it. I don't blame the banking apps, it makes sense given their incentives and constraints. But if Play Integrity existed to serve the user, it would answer only to the user, and not "snitch" the device integrity status to apps and their backends.