3 ms·

Jolla has announced a new phone using its Sailfish OS so providing a full-stack European alternative to the Android/Apple duopoly.

joe_mamba 7mo ago
Yeah but the core issue is that all apps for digital services for both private and government, at least in my EU country, are only shipped for the iOS/Android duopoly. So having yet another 100th FOSS linux phone that won't run those apps is pointless until apps for these phones are shipped with feature parity, and they probably won't get shipped until these phones reach some critical mass adoption, and they won't get critical mass adoption because they don't run the popular apps.
- actionfromafar 7mo ago
  Jolla phones can run Android apps.
  - maratc 7mo ago
    Your point seems to be "Some Jolla phones can run some Android apps," while GP's issue is that "It's not true that all Jolla phones can run all Android apps."
  - Taro3 7mo ago
    [dead]
- Risse 7mo ago
  Check out this thread on Sailfish OS forums regarding EU Banking apps. I was surprised on how many actually work. https://forum.sailfishos.org/t/banking-apps-on-sailfish-os/18438 https://forum.sailfishos.org/t/banking-apps-on-sailfish-os/1...
  - joe_mamba 7mo ago
    If this is similar to LineageOS, then it's always potentially only a matter of time until some banking and payment apps stop working due to failing security attestation pushed by a Google update. We need native apps that pass attestation out of the box for that phone/OS, not relying on hacks that may or may not work in the future. This is not good UX and it poisons the well if you push users to a new platform then they discover some apps don't work as you promised.
    - femto 7mo ago
      Beats me why banks can't use a FIDO2 enabled web site.
      - joe_mamba 7mo ago
        Banks used to give us those RSA tokens in the past for securely logging in to the web UI, but then discovered they can cut down on cost since everyone has two brands of smartphones.
        femto 7mo ago
        No doubt. At least with FIDO2, people can provide their own hardware key, and get real security rather than a rolling number generated by a compromised algorithm [1]. [1] https://en.wikipedia.org/wiki/RSA_SecurID#March_2011_system_compromise https://en.wikipedia.org/wiki/RSA_SecurID#March_2011_system_...
      - Hackbraten 7mo ago
        Because FIDO2 is not enough for non-tech-savvy people. The main issue is potential confusion about what transaction they’re actually signing. For example, a malicious browser extension can pretend the site sends money to X while actually sending it to Y. The European PSD2 directive mandates that the 2FA scheme must let the user see what they’re about to sign. At the very least, that includes the amount and part of the recipient’s IBAN. FIDO2 doesn’t have that. It’s the reason I own a device that looks like this [0]. Without it, I wouldn’t be able to transfer money at all due to the lack of banking apps that work on Linux phones. [0]: https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program

joe_mamba 7mo ago

Yeah but the core issue is that all apps for digital services for both private and government, at least in my EU country, are only shipped for the iOS/Android duopoly. So having yet another 100th FOSS linux phone that won't run those apps is pointless until apps for these phones are shipped with feature parity, and they probably won't get shipped until these phones reach some critical mass adoption, and they won't get critical mass adoption because they don't run the popular apps.

actionfromafar 7mo ago
Jolla phones can run Android apps.
- maratc 7mo ago
  Your point seems to be "Some Jolla phones can run some Android apps," while GP's issue is that "It's not true that all Jolla phones can run all Android apps."
- Taro3 7mo ago
  [dead]
Risse 7mo ago
Check out this thread on Sailfish OS forums regarding EU Banking apps. I was surprised on how many actually work. https://forum.sailfishos.org/t/banking-apps-on-sailfish-os/18438 https://forum.sailfishos.org/t/banking-apps-on-sailfish-os/1...
- joe_mamba 7mo ago
  If this is similar to LineageOS, then it's always potentially only a matter of time until some banking and payment apps stop working due to failing security attestation pushed by a Google update. We need native apps that pass attestation out of the box for that phone/OS, not relying on hacks that may or may not work in the future. This is not good UX and it poisons the well if you push users to a new platform then they discover some apps don't work as you promised.
  - femto 7mo ago
    Beats me why banks can't use a FIDO2 enabled web site.
    - joe_mamba 7mo ago
      Banks used to give us those RSA tokens in the past for securely logging in to the web UI, but then discovered they can cut down on cost since everyone has two brands of smartphones.
      - femto 7mo ago
        No doubt. At least with FIDO2, people can provide their own hardware key, and get real security rather than a rolling number generated by a compromised algorithm [1]. [1] https://en.wikipedia.org/wiki/RSA_SecurID#March_2011_system_compromise https://en.wikipedia.org/wiki/RSA_SecurID#March_2011_system_...
    - Hackbraten 7mo ago
      Because FIDO2 is not enough for non-tech-savvy people. The main issue is potential confusion about what transaction they’re actually signing. For example, a malicious browser extension can pretend the site sends money to X while actually sending it to Y. The European PSD2 directive mandates that the 2FA scheme must let the user see what they’re about to sign. At the very least, that includes the amount and part of the recipient’s IBAN. FIDO2 doesn’t have that. It’s the reason I own a device that looks like this [0]. Without it, I wouldn’t be able to transfer money at all due to the lack of banking apps that work on Linux phones. [0]: https://en.wikipedia.org/wiki/Chip_Authentication_Program https://en.wikipedia.org/wiki/Chip_Authentication_Program