4 ms·
All of the listed features significantly raise the bar for exploitation ; https://grapheneos.org/features https://grapheneos.org/features
by tranq_cassowary 1y ago
All of the listed features significantly raise the bar for exploitation ;
https://grapheneos.org/features https://grapheneos.org/features
- dotancohen 1y agoSo Graphene is actually more secure than most stock ROMs, but e.g. banking apps won't run on it "for security"? Why can't the stock ROMs use these features and be more secure also?
- latentsea 1y agoMy banking apps run on it, but my concert ticket app doesn't, so I have a separate phone just for that one app.
- dotancohen 1y agoCan concert tickets not be bought in a web browser?
- spencerflem 1y agoNo they can’t. It’s very frustrating. I had to get my friend to buy them for me when I was on Graphene
- latentsea 1y agoNope. This is eplus in Japan, and if you try go through the website it tells you you have to use the app. It's cos a lot of shows these days don't use paper tickets, but smart tickets on your phone. It is what it is.
- dotancohen 1y agoWhat about people who do not have a smartphone?
- latentsea 1y agoThey don't get to go to concerts in Japan.
- ExpertAdvisor01 1y agoThey do it to prevent botting . They use play integrity ( i think ex safety net ).
- rfoo 1y ago> Why can't the stock ROMs use these features and be more secure also? Some of the features may hurt user experience in some way and people made different trade-off. For example, GrapheneOS disables USB before unlock so that there's no chance that some driver codes in Linux kernel run in response to a device being plugged in, for attack surface reduction. Then, say, if you have a cracked screen, the touchscreen no longer works and you don't want to fix it, if not for this mitigation, you can use an USB-C OTG cable to connect a mouse / keyboard to the phone, unlock it and export all your data. With this mitigation the keyboard won't work so you are forced to fix the screen first just to get your data out.
- kube-system 1y agoThat also sounds like a nonstarter for a lot of kiosk and embedded use cases
- subscribed 1y agoOkay? Then switch that off? :)
- deleted 1y ago[deleted]
- cft 1y agoMost American banking apps run on Graphene https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/#united-states https://privsec.dev/posts/android/banking-applications-compa...
- gf000 1y agoA good deal of banking apps will run on it just fine. Some of these features are backported to mainline android, others may be deemed too advanced or just the incentives don't match (e.g. being able to disable networking by the user could cut into Google's earnings, e.g. limited ads in apps).
- etatoby 1y agoFor what its worth, all of my local banking and e-government apps work flawlessly on GrapheneOS. The only unsupported feature or app I've found so far is Google Pay. (I'm from Italy)
- bjackman 1y agoIf apps refuse to run on graphene it's not because of graphene's content it's just a question of whether the attestation is recognised. It's not signed by Google. I guess one reason you'd want to avoid that is that makes it harder to e.g spoof your location or falsely tell the app that screenshotting is disabled.
- ExpertAdvisor01 1y agoIt's mostly preventing apps to be botted . As each device has its own certificate and can be banned exclusively, if it's google certified. This certificate( also called keybox/keybox.xml) is stored in the secure enclave in the device. If you want to dive deeper you can checkout droidguard/play integrity.
- chasil 1y agoWells Fargo runs on my Grapheme device. It also runs on Lineage with Mind The Gapps.
- ExpertAdvisor01 1y agoBecause these apps use google play integrity which only google certified devices pass