3 ms·

GrapheneOS isn't going anywhere. People keep getting all anxious when they see news and don't seem to understand the facts. The lead developer was conscripted,

GrapheneOS isn't going anywhere. People keep getting all anxious when they see news and don't seem to understand the facts. The lead developer was conscripted, but the rest of the development team prepared for Android 16 and the port was completed in a couple of days. Device-specific repositories were not included by Google this time, so while the port was finished quickly, they had to work around this. And now GrapheneOS has finished the Android 16 port. So I'm not sure why people need to freak out and start using insecure devices because they _think_ something will happen with no proof. The fact is GrapheneOS is still going strong. And you can see they've been talking about talks with a big OEM on their socials, so even if new Pixels can't be supported in the future, other OEMs are interested.

sunshine-o 1y ago
To be clear I am freaking out about the Android ecosystem. As of today I already need an 2 Android phones 1/ One Google Android phone for my banking app with Google Integrity API working 2/ One GrapheneOS phone for everything else I could switch bank for the 3rd time, sure. But how long can I run away? So what I meant is hopefully in the future we will have a GrapheneOS hardware device, but they might also need to fork or leave AOSP. Because trying to be in the Google Android ecosystem and out of it at the same time became impossible or too costly. We can't spent most of our resources trying fit in instead of creating our own path.
- jeroenhd 1y ago
  I don't think GrapheneOS supports it, but back in the day I dual-booted my Oneplus One at some point. That solution worked on Windows with DRM and anti-cheat, so it may be a partial solution on Android too. I imagine at some point a ROM might use pKVM to boot a copy of Android that passes Play Integrity checks through the necessary spoofs without altering the host OS. The Play Integrity API is working. Banking apps rejecting GrapheneOS' hashes has nothing to do with Google Android vs AOSP and everything to do with what the banks decide is an acceptable risk. GrapheneOS implements everything the Play Integrity API needs and is completely honest about doing so. That's unlike many custom ROMs that lie to Google and spoof a device that doesn't support hardware attestation, which makes many banking apps work.
  - strcat 1y ago
    > I don't think GrapheneOS supports it, but back in the day I dual-booted my Oneplus One at some point. That solution worked on Windows with DRM and anti-cheat, so it may be a partial solution on Android too. It's not compatible with the hardware-based security features and atomic A/B update system. > I imagine at some point a ROM might use pKVM to boot a copy of Android that passes Play Integrity checks through the necessary spoofs without altering the host OS. Spoofing is not going to pass the Play Integrity API strong integrity level and the device integrity level will keep moving closer to enforcing hardware attestation too. > The Play Integrity API is working. Banking apps rejecting GrapheneOS' hashes has nothing to do with Google Android vs AOSP and everything to do with what the banks decide is an acceptable risk. Play Integrity API does not allow anything other than Google Mobile Services devices with the stock OS to pass the device or strong integrity levels. Passing any of basic, device or strong requires being logged into a Google account now too. GrapheneOS provides full support for hardware-based attestation which apps can use to permit both any stock OS and also GrapheneOS or other alternate operating systems. Most apps choose to simply do what Google recommends of not allowing anything not licensing Google Mobile Services with no check for minimum patch level, etc. It's not really a security feature. > GrapheneOS implements everything the Play Integrity API needs and is completely honest about doing so. We do, but Google chooses not to allow GrapheneOS. They may be forced to change that soon due to EU regulation. Several apps in the EU have chosen to permit GrapheneOS via using the hardware attestation API themselves but what's really needed is Google being forced to do it. > That's unlike many custom ROMs that lie to Google and spoof a device that doesn't support hardware attestation, which makes many banking apps work. That only passes the device integrity level and many banking apps are moving to the strong integrity level. It's also getting harder to do it and Google has detection for it which is being used for an extremely slow moving crackdown on it. They're likely doing it so slowly to avoid making too many people angry at once leading to serious pushback against it. They're mostly fine with people passing it for now, which they can detect is happening via their fingerprinting system. They're choosing to allow it when it's not for wide scale abuse. They would prevent it if an OS like GrapheneOS with 350k+ users deployed it with perhaps around half of the users were using it due to using sandboxed Google Play. If we made it a toggle, it would still likely be too large scale to get away with it.
- strcat 1y ago
  > 1/ One Google Android phone for my banking app with Google Integrity API working Most banks permit using GrapheneOS. It's also possible to do most things via online banking. Generally only a fcertain things like cashing a cheque requires a native app. > So what I meant is hopefully in the future we will have a GrapheneOS hardware device, but they might also need to fork or leave AOSP. Because trying to be in the Google Android ecosystem and out of it at the same time became impossible or too costly. We're actively working with a major Android OEM towards their future devices providing official GrapheneOS support. Not really clear why we'd need to switch the base for the OS. We'd still need a fork of AOSP if we want Android app compatibility. If we didn't have Android app compatibility, you'd probably have a lot more reasons you couldn't use it as your only device than a single banking apps. Same applies to most users. > I could switch bank for the 3rd time, sure. But how long can I run away? Several European banks have explicitly chosen to permit GrapheneOS via https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu.... We're hoping EU regulation requires Google to stop banning it from banning the Play Integrity API since we provide everything they need to verify GrapheneOS via hardware-based attestation. It shouldn't be up to Google which devices and operating systems are allowed to use mainstream apps and regulators generally agree with that. It's just taking a long time for regulators to understand it and do something about it. We expect it will happen. > We can't spent most of our resources trying fit in instead of creating our own path. We've hardly put any resources into this. There's not really much we can do about apps deliberately trying to stop people using another OS including GrapheneOS. It's more of an issue to solve via convincing them to permit it than a technical one. A technical workaround would only be a temporary hack likely to break fairly quickly.

sunshine-o 1y ago

To be clear I am freaking out about the Android ecosystem. As of today I already need an 2 Android phones 1/ One Google Android phone for my banking app with Google Integrity API working 2/ One GrapheneOS phone for everything else I could switch bank for the 3rd time, sure. But how long can I run away? So what I meant is hopefully in the future we will have a GrapheneOS hardware device, but they might also need to fork or leave AOSP. Because trying to be in the Google Android ecosystem and out of it at the same time became impossible or too costly. We can't spent most of our resources trying fit in instead of creating our own path.

jeroenhd 1y ago
I don't think GrapheneOS supports it, but back in the day I dual-booted my Oneplus One at some point. That solution worked on Windows with DRM and anti-cheat, so it may be a partial solution on Android too. I imagine at some point a ROM might use pKVM to boot a copy of Android that passes Play Integrity checks through the necessary spoofs without altering the host OS. The Play Integrity API is working. Banking apps rejecting GrapheneOS' hashes has nothing to do with Google Android vs AOSP and everything to do with what the banks decide is an acceptable risk. GrapheneOS implements everything the Play Integrity API needs and is completely honest about doing so. That's unlike many custom ROMs that lie to Google and spoof a device that doesn't support hardware attestation, which makes many banking apps work.
- strcat 1y ago
  > I don't think GrapheneOS supports it, but back in the day I dual-booted my Oneplus One at some point. That solution worked on Windows with DRM and anti-cheat, so it may be a partial solution on Android too. It's not compatible with the hardware-based security features and atomic A/B update system. > I imagine at some point a ROM might use pKVM to boot a copy of Android that passes Play Integrity checks through the necessary spoofs without altering the host OS. Spoofing is not going to pass the Play Integrity API strong integrity level and the device integrity level will keep moving closer to enforcing hardware attestation too. > The Play Integrity API is working. Banking apps rejecting GrapheneOS' hashes has nothing to do with Google Android vs AOSP and everything to do with what the banks decide is an acceptable risk. Play Integrity API does not allow anything other than Google Mobile Services devices with the stock OS to pass the device or strong integrity levels. Passing any of basic, device or strong requires being logged into a Google account now too. GrapheneOS provides full support for hardware-based attestation which apps can use to permit both any stock OS and also GrapheneOS or other alternate operating systems. Most apps choose to simply do what Google recommends of not allowing anything not licensing Google Mobile Services with no check for minimum patch level, etc. It's not really a security feature. > GrapheneOS implements everything the Play Integrity API needs and is completely honest about doing so. We do, but Google chooses not to allow GrapheneOS. They may be forced to change that soon due to EU regulation. Several apps in the EU have chosen to permit GrapheneOS via using the hardware attestation API themselves but what's really needed is Google being forced to do it. > That's unlike many custom ROMs that lie to Google and spoof a device that doesn't support hardware attestation, which makes many banking apps work. That only passes the device integrity level and many banking apps are moving to the strong integrity level. It's also getting harder to do it and Google has detection for it which is being used for an extremely slow moving crackdown on it. They're likely doing it so slowly to avoid making too many people angry at once leading to serious pushback against it. They're mostly fine with people passing it for now, which they can detect is happening via their fingerprinting system. They're choosing to allow it when it's not for wide scale abuse. They would prevent it if an OS like GrapheneOS with 350k+ users deployed it with perhaps around half of the users were using it due to using sandboxed Google Play. If we made it a toggle, it would still likely be too large scale to get away with it.
strcat 1y ago
> 1/ One Google Android phone for my banking app with Google Integrity API working Most banks permit using GrapheneOS. It's also possible to do most things via online banking. Generally only a fcertain things like cashing a cheque requires a native app. > So what I meant is hopefully in the future we will have a GrapheneOS hardware device, but they might also need to fork or leave AOSP. Because trying to be in the Google Android ecosystem and out of it at the same time became impossible or too costly. We're actively working with a major Android OEM towards their future devices providing official GrapheneOS support. Not really clear why we'd need to switch the base for the OS. We'd still need a fork of AOSP if we want Android app compatibility. If we didn't have Android app compatibility, you'd probably have a lot more reasons you couldn't use it as your only device than a single banking apps. Same applies to most users. > I could switch bank for the 3rd time, sure. But how long can I run away? Several European banks have explicitly chosen to permit GrapheneOS via https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu.... We're hoping EU regulation requires Google to stop banning it from banning the Play Integrity API since we provide everything they need to verify GrapheneOS via hardware-based attestation. It shouldn't be up to Google which devices and operating systems are allowed to use mainstream apps and regulators generally agree with that. It's just taking a long time for regulators to understand it and do something about it. We expect it will happen. > We can't spent most of our resources trying fit in instead of creating our own path. We've hardly put any resources into this. There's not really much we can do about apps deliberately trying to stop people using another OS including GrapheneOS. It's more of an issue to solve via convincing them to permit it than a technical one. A technical workaround would only be a temporary hack likely to break fairly quickly.