3 ms·

Anyone know if partnering with a major OEM for official support makes it more likely that they will be able to consistently support things like banking apps (an

Anyone know if partnering with a major OEM for official support makes it more likely that they will be able to consistently support things like banking apps (and maybe even payment apps) in the future? I suspect the answer is "no" but I want to believe...

zb3 1y ago
If those apps use "Play Integrity" (bad choice) then the probability is close to zero because it's Google that controls it. Other OEMs that currently pass it do it only because the device was certified by Google. But being certified by Google of course precludes not preinstalling or sandboxing their GMS apps.
IlikeKitties 1y ago
The answer is it depends. Banking and similar Apps trying to "protect" the user from themselves aka treat the user like a retarded child do this through several mechanisms: > Google Play Integrity Essentially a Google API that App Developers integrate that checks if the device runs an Operating System signed by Google as "Play Certified". This can go as far as being backed by a hardware trusted platform module. I doubt Google will certify GrapheneOS given their modifications towards sandboxing the play services. This can be faked to a degree but GrapheneOS choses not to do it and to fake the TPM part you need leaked keys. For more details on how to fake it look at this thread: https://xdaforums.com/t/guide-how-to-pass-strong-integrity-on-android-step-by-step-guide.4729435/ https://xdaforums.com/t/guide-how-to-pass-strong-integrity-o... > Fingerprinting the Device OS This can very from app to app and just tries to fingerprint the device in many ways to see if it's running a custom rom of some kind. This does things like check to see if the bootloader is unlocked or if root is installed. I think this is something an official grapheneos phone might fix since the phone vendor could allow grapheneos to sign their releases as native equivalent > Banning GrapheneOS by Name Some Apps Developers literally ban GrapheneOS by name. > Failures due to Google Play Sandboxing Since GrapheneOS sandboxes Google Play Services there might be compatibility issues that prevent the app from working right. This would likely be unaffected by a GrapheneOS Phone. > Failures due to Advanced Security Features Some Apps just don't "like" the advanced security features like the hardened malloc and other protections and just fail. This can be disabled most of the time
baobun 1y ago
The situation you're alluding to is not a case of "GrapheneOS doesn't support banking apps" but rather "Some app publishers employ Google Play Protect and other measures in order to explicitly block GrapheneOS". GrapheneOS can not do anything about that. Choose your banking and payment apps accordingly. FWIW I have run several banking apps on GrapheneOS without any issues whatsoever, never had any blocks or compatibility issues. Might just be luck of the draw but just to say you probably do have options.
- NoboruWataya 1y ago
  Yes, I understand many banking apps do work and from reports I have read online it even seems like a couple of the banking apps I use are among the good ones. What gives me pause is how fragile the situation is. Banking apps get "upgraded" all the time to include new security "features". Already I have had my main banking app refuse to work because I had accessibility features enabled for a different app, and subsequently refuse to work again because I had developer mode enabled. If my banking app works on GrapheneOS I am convinced it is because the bank has not gotten round to blocking it yet and it's only a matter of time, unfortunately.
  - warkdarrior 1y ago
    If you want your bank to take the liability for any monetary losses from your account getting hacked (for example, through spyware using accessibility on Android), then you have to be OK with their requirements. If you don't like their requirements, you need to take the liability yourself. You could use PayPal or a stablecoin to store your money.
    - spaqin 1y ago
      Or root with Magisk and hide the developer mode from the offending app. Unfortunately it's always a cat and mouse game, so for some apps it's probably easiest to have a cheap, outdated (and by some metrics thus unsafe) device in a drawer at home. Your money is far more at risk with scams and phishing than it is with whatever boogeyman spyware you may try to think of that does not exist in real life.
xethos 1y ago
I sincerely doubt it, but a large OEM with first-party support makes it (IMO) more likely for banking apps to support GApps-less handsets(instead of the inverse, Graphene supporting banking apps) - a dramatically better outcome, as that allows Waydroid more breathing room as a viable solution for Linux-first handsets too. This would of course be contigent on GrapheneOS growing their market- and mind-share in the general public, while also taking several years to impact the least move-fast-and-break-things industry (consumer banking). But still, a man can dream.
esseph 1y ago
If the phone is rooted, most banks will not support it. That includes grapheneOS.
- MaximilianEmel 1y ago
  Your phone isn't rooted on GrapheneOS.
- deleted 1y ago
  [deleted]
- hardran3 1y ago
  GOS isn't rooted.
  - esseph 1y ago
    Apologies meant bootloader unlocked
    - akimbostrawman 1y ago
      Relocking bootloader is part of installing GOS
      - esseph 1y ago
        Cool, I didn't know that!

zb3 1y ago

If those apps use "Play Integrity" (bad choice) then the probability is close to zero because it's Google that controls it. Other OEMs that currently pass it do it only because the device was certified by Google. But being certified by Google of course precludes not preinstalling or sandboxing their GMS apps.

IlikeKitties 1y ago

The answer is it depends. Banking and similar Apps trying to "protect" the user from themselves aka treat the user like a retarded child do this through several mechanisms: > Google Play Integrity Essentially a Google API that App Developers integrate that checks if the device runs an Operating System signed by Google as "Play Certified". This can go as far as being backed by a hardware trusted platform module. I doubt Google will certify GrapheneOS given their modifications towards sandboxing the play services. This can be faked to a degree but GrapheneOS choses not to do it and to fake the TPM part you need leaked keys. For more details on how to fake it look at this thread: https://xdaforums.com/t/guide-how-to-pass-strong-integrity-on-android-step-by-step-guide.4729435/ https://xdaforums.com/t/guide-how-to-pass-strong-integrity-o... > Fingerprinting the Device OS This can very from app to app and just tries to fingerprint the device in many ways to see if it's running a custom rom of some kind. This does things like check to see if the bootloader is unlocked or if root is installed. I think this is something an official grapheneos phone might fix since the phone vendor could allow grapheneos to sign their releases as native equivalent > Banning GrapheneOS by Name Some Apps Developers literally ban GrapheneOS by name. > Failures due to Google Play Sandboxing Since GrapheneOS sandboxes Google Play Services there might be compatibility issues that prevent the app from working right. This would likely be unaffected by a GrapheneOS Phone. > Failures due to Advanced Security Features Some Apps just don't "like" the advanced security features like the hardened malloc and other protections and just fail. This can be disabled most of the time

baobun 1y ago

The situation you're alluding to is not a case of "GrapheneOS doesn't support banking apps" but rather "Some app publishers employ Google Play Protect and other measures in order to explicitly block GrapheneOS". GrapheneOS can not do anything about that. Choose your banking and payment apps accordingly. FWIW I have run several banking apps on GrapheneOS without any issues whatsoever, never had any blocks or compatibility issues. Might just be luck of the draw but just to say you probably do have options.

NoboruWataya 1y ago
Yes, I understand many banking apps do work and from reports I have read online it even seems like a couple of the banking apps I use are among the good ones. What gives me pause is how fragile the situation is. Banking apps get "upgraded" all the time to include new security "features". Already I have had my main banking app refuse to work because I had accessibility features enabled for a different app, and subsequently refuse to work again because I had developer mode enabled. If my banking app works on GrapheneOS I am convinced it is because the bank has not gotten round to blocking it yet and it's only a matter of time, unfortunately.
- warkdarrior 1y ago
  If you want your bank to take the liability for any monetary losses from your account getting hacked (for example, through spyware using accessibility on Android), then you have to be OK with their requirements. If you don't like their requirements, you need to take the liability yourself. You could use PayPal or a stablecoin to store your money.
  - spaqin 1y ago
    Or root with Magisk and hide the developer mode from the offending app. Unfortunately it's always a cat and mouse game, so for some apps it's probably easiest to have a cheap, outdated (and by some metrics thus unsafe) device in a drawer at home. Your money is far more at risk with scams and phishing than it is with whatever boogeyman spyware you may try to think of that does not exist in real life.

xethos 1y ago

I sincerely doubt it, but a large OEM with first-party support makes it (IMO) more likely for banking apps to support GApps-less handsets(instead of the inverse, Graphene supporting banking apps) - a dramatically better outcome, as that allows Waydroid more breathing room as a viable solution for Linux-first handsets too. This would of course be contigent on GrapheneOS growing their market- and mind-share in the general public, while also taking several years to impact the least move-fast-and-break-things industry (consumer banking). But still, a man can dream.

esseph 1y ago

If the phone is rooted, most banks will not support it. That includes grapheneOS.

MaximilianEmel 1y ago
Your phone isn't rooted on GrapheneOS.
deleted 1y ago
[deleted]
hardran3 1y ago
GOS isn't rooted.
- esseph 1y ago
  Apologies meant bootloader unlocked
  - akimbostrawman 1y ago
    Relocking bootloader is part of installing GOS
    - esseph 1y ago
      Cool, I didn't know that!