3 ms·

I wonder if a real OEM supports graphene if that would solve device attestation for things like banking apps.

by hamandcheese 10mo ago

deleted 10mo ago
[deleted]
rl3 10mo ago
Never underestimate stupid, especially for that sector.
rjdj377dhabsn 10mo ago
Non-Google attestation is still a bad thing. I'd much rather GrapheneOS continue to get popular enough that banking apps are forced to support phones without attestation.
- 7bit 10mo ago
  Will never happen. Banks will not support this unless insurance companies include that. And that will never happen because they will never support something that a large company doesn't committ to.
  - subscribed 10mo ago
    Some do. Don't want to give out names, but it's slowly happening.
- subscribed 10mo ago
  What do you mean? Graphene OS devices DO support Hardware-based attestation (AOSP standard), they just don't support STRONG or DEVICE Play integrity checks. Now developers can choose to support it (and some of the developers do!) aside or apart of google "attestation". How it should be, reliable providers should be able to certify it equally firmly. Google should be forced to accept a valid hardware-attestation certification as their own. GOS have raise the issue with the European Commission and I hope Google will get fined and forced. in quotes because it mostly confirms that google runs in the privileged mode and can't detect one of the issues. But google also gives a pass to many very old, insecure, rooted devices. It's a scam.
speakspokespok 10mo ago
I'm writing this on a grapheneos pixel 5. I have the app for very-large-USbank and a few others. With 'exploit protection compatibility toggle' enabled they works fine. In what regard this applies to device attestation I couldn't say.
- subscribed 10mo ago
  It doesn't. The app likely uses one of the others, dumb methods of detection.
udev4096 10mo ago
[dead]
jhasse 10mo ago
GrapheneOS has device attestation support on Pixel devices, i.e. it passes SafetyNet. It's just that some apps (e.g. Google Pay) explicitly exclude it.

I wonder if a real OEM supports graphene if that would solve device attestation for things like banking apps.

deleted 10mo ago

[deleted]

rl3 10mo ago

Never underestimate stupid, especially for that sector.

rjdj377dhabsn 10mo ago

Non-Google attestation is still a bad thing. I'd much rather GrapheneOS continue to get popular enough that banking apps are forced to support phones without attestation.

7bit 10mo ago
Will never happen. Banks will not support this unless insurance companies include that. And that will never happen because they will never support something that a large company doesn't committ to.
- subscribed 10mo ago
  Some do. Don't want to give out names, but it's slowly happening.
subscribed 10mo ago
What do you mean? Graphene OS devices DO support Hardware-based attestation (AOSP standard), they just don't support STRONG or DEVICE Play integrity checks. Now developers can choose to support it (and some of the developers do!) aside or apart of google "attestation". How it should be, reliable providers should be able to certify it equally firmly. Google should be forced to accept a valid hardware-attestation certification as their own. GOS have raise the issue with the European Commission and I hope Google will get fined and forced. in quotes because it mostly confirms that google runs in the privileged mode and can't detect one of the issues. But google also gives a pass to many very old, insecure, rooted devices. It's a scam.

speakspokespok 10mo ago

I'm writing this on a grapheneos pixel 5. I have the app for very-large-USbank and a few others. With 'exploit protection compatibility toggle' enabled they works fine. In what regard this applies to device attestation I couldn't say.

subscribed 10mo ago
It doesn't. The app likely uses one of the others, dumb methods of detection.

udev4096 10mo ago

[dead]

jhasse 10mo ago

GrapheneOS has device attestation support on Pixel devices, i.e. it passes SafetyNet. It's just that some apps (e.g. Google Pay) explicitly exclude it.