3 ms·

GrapheneOS phones are still an option, it’s unaffected by these rules.

by armadyl 7mo ago

egeres 7mo ago
They have terrible support for banking apps and any app that needs play integrity
- armadyl 7mo ago
  And what kind of support do you think a Linux phone will have? While also having trash tier security. I don’t see that as an issue (for Americans at least since most banks here don’t use NFC/wallets in their apps), just use the web browser to access your bank. Also GrapheneOS has in my experience decent banking app support outside of a handful of apps (including, ironically, my main bank which disabled GrapheneOS support a week or two ago). There is a maintained list of working apps that you can see for yourself: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
- jjulius 7mo ago
  Does/do your bank/s absolutely always require you to use an app? Is there a desktop/website that you can use? Do they have a brick and mortar location?
  - utopiah 7mo ago
    Typically the website requires you to use the mobile app as 2FA. Typically also there are less and less brick and mortar locations.
    - jjulius 7mo ago
      Help me follow. Which bank, specifically, requires an app for the purpose of 2FA? Further, what is the 2FA process for logging in to the app itself - wouldn't you need a second form of authentication that's not the app in that instance? If so, is that form of 2FA not allowed when logging in via desktop/laptop? I inquire because I use multiple different banks, CC providers and financial services, but have never once been required to use an app, even with "mobile" banks like Simple or One.
      - utopiah 7mo ago
        Sure, just an example ING (part of ING Group, 34th bank in the world according to https://en.wikipedia.org/wiki/List_of_largest_banks https://en.wikipedia.org/wiki/List_of_largest_banks only highlighting this to show it's not a tiny random "weird" corner shop) requires to use either their mobile application or ItsMe (details https://fr.wikipedia.org/wiki/Itsme https://fr.wikipedia.org/wiki/Itsme if you want but basically also 2FA as a mobile app) in order to login to their consumer/professional website. You can from the mobile app scan a QR-code which in turn will ask for authentification, e.g. biometrics. Yes indeed registering the mobile application itself requires first another form of authentication, typically an SMS confirming the number plus a physical card with a physical card reader. You then input the resulting token in the app which validates it and then you don't need the card reader anymore while you rely on the mobile app. AFAICT the physical card reader options is not offered on some mobile payment options. I do not know if they are phasing it out of if it is because another method exists, namely if you have NOT registered their mobile application as a 2FA method, can you still use the physical card and card reader. I do not know that. To be clear they do NOT require an app per se. They do though if you want to use online services, including payments, bank transfer, reading specific kind of documents, adding specific recipients for recurring transfer, transfer above thresholds, etc. Hope it helps. If I missed something happy to try to clarify. Also FWIW and AFAICT it's getting more and more common for online services from bank in the EU.
- drnick1 7mo ago
  Then don't use those apps. I know it's easier said than done sometimes, but freedom is more important than convenience.
  - deaux 7mo ago
    Yeah, just like, move to a country where banks still offer web banking, bro. Move banks. Got a locked down mortgage on good rates? Tough luck man. Etc
    - Hackbraten 7mo ago
      What are you trying to do with your mortgage using a mobile phone?
    - deleted 7mo ago
      [deleted]
- MrDresden 7mo ago
  You are badly informed. GrapheneOS has full support for Play Integrity[0]. [0]: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
  - odo1242 7mo ago
    The link you link literally explains how GrapheneOS doesn’t support Play Integrity and apps should use the Hardware Attestation API instead.
    - microtonal 7mo ago
      I think you are both kind of wrong :). There are different Play Integrity levels. GrapheneOS passes the basic level, which is enough for many apps, including a bunch of European banking apps. GrapheneOS does not pass the strong level, which does remote attestation, but Google does not want to add the GrapheneOS signing key fingerprints. My European banking and credit card apps work fine on GrapheneOS because they don't require the strong integrity level. Google is using Play Integrity at the strong level to shut down competition. It's kinda ironic, since GrapheneOS is much more secure than the many phones out there with abysmal device security and slow updates that Google does accept with strong integrity.
    - MrDresden 7mo ago
      Yeah you're right, serves me right for writing that while busy doing other things this morning. The intent of the comment stands though. I meant to point out that GrapheneOS has perfectly good support for verifying device integrity via Hardware Attestation, just not the method which requires Google to acknowledge the OS signing keys.
- gib444 7mo ago
  "Terrible" is incorrect. Yes quite a few don't work but many many do . See: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
- lawn 7mo ago
  All Swedish banking apps work without issue and many apps that use play integrity works well regardless. It's just some apps that use play integrity that in a certain way that doesn't work.
- imhoguy 7mo ago
  Then keep Google crapphone for banking purposes in your drawer, like auth scratch code cards in the past. I don't get that idea of carrying device with bank access in your pocket constantly. Moreover, at least in EU, there is more and more banks which publish their apps in non Google app stores too.
- goda90 7mo ago
  I've had multiple apps attempt to use Play Integrity on my GrapheneOS phone(it tells you when they try), and then just work anyway. Not sure why.
stavros 7mo ago
If they manage to expand their lineup a bit, that'll be my next phone. Or, if a company makes a phone with GrapheneOS preinstalled, I'm giving them my money. Fuck Google for doing this, and Play Integrity making me unable to use banks is even worse.
- armadyl 7mo ago
  They're actually partnering with Motorola and have phones coming out next year! It sounds like they'll be the Motorola Signature, Razr and Fold (iirc).
  - stavros 7mo ago
    That's great news, thanks! I can keep my phone for another year.
- utopiah 7mo ago
  > if a company makes a phone with GrapheneOS preinstalled, I'm giving them my money. FWIW you can buy a Pixel (new or 2nd hand) and install GrapheneOS via the Web https://grapheneos.org/install/web https://grapheneos.org/install/web with nothing (genuinely nothing) installed on your computer and get it working in ~15min (depending on your connection to download the ROM) out of which maybe ~2min will be your interacting with the setup process. I initially bought an /e/OS precisely with your requirement, namely I "just" want a phone that works when I receive it, no tinkering, but having installed GrapheneOS myself few days (or weeks?) ago I can tell you, it's really straightforward.
  - goda90 7mo ago
    > with nothing (genuinely nothing) installed on your computer Not 100% accurate. You need a browser that supports WebUSB[0] which are just Chromium based ones, not Safari or Firefox. [0]https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API
    - 7mo ago
sneak 7mo ago
Used Graphene as a daily driver for a year. It’s an unserious toy.
- yoavm 7mo ago
  Can you elaborate? Why? I think many of us were hoping we could switch to it if/when Android becomes intolerable.
  - microtonal 7mo ago
    I have no idea what they are talking about. I have been daily driving GrapheneOS for almost two months now (coming from iPhone, but I have tested Pixels and Samsung phones on the side for a while) and there is no material difference in daily use from running the stock Pixel OS in daily use if you install Play (Services) and a bunch of apps. Of course, it is more secure and comes with no crap pre-installed, which is nice. The only thing I have really found missing is Google Pay support for contactless payment (because Google doesn't want to allow GrapheneOS, but there are alternatives like Curve).
- lawn 7mo ago
  I'm using GrapheneOS as my daily driver you couldn't be more wrong.
- uncognic 7mo ago
  If it really was, you wouldn't have used it for a year
goodpoint 7mo ago
It's pretty crazy to trust such project to run your phone.

GrapheneOS phones are still an option, it’s unaffected by these rules.

by armadyl 7mo ago

GrapheneOS phones are still an option, it’s unaffected by these rules.

egeres 7mo ago

They have terrible support for banking apps and any app that needs play integrity

armadyl 7mo ago
And what kind of support do you think a Linux phone will have? While also having trash tier security. I don’t see that as an issue (for Americans at least since most banks here don’t use NFC/wallets in their apps), just use the web browser to access your bank. Also GrapheneOS has in my experience decent banking app support outside of a handful of apps (including, ironically, my main bank which disabled GrapheneOS support a week or two ago). There is a maintained list of working apps that you can see for yourself: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
jjulius 7mo ago
Does/do your bank/s absolutely always require you to use an app? Is there a desktop/website that you can use? Do they have a brick and mortar location?
- utopiah 7mo ago
  Typically the website requires you to use the mobile app as 2FA. Typically also there are less and less brick and mortar locations.
  - jjulius 7mo ago
    Help me follow. Which bank, specifically, requires an app for the purpose of 2FA? Further, what is the 2FA process for logging in to the app itself - wouldn't you need a second form of authentication that's not the app in that instance? If so, is that form of 2FA not allowed when logging in via desktop/laptop? I inquire because I use multiple different banks, CC providers and financial services, but have never once been required to use an app, even with "mobile" banks like Simple or One.
    - utopiah 7mo ago
      Sure, just an example ING (part of ING Group, 34th bank in the world according to https://en.wikipedia.org/wiki/List_of_largest_banks https://en.wikipedia.org/wiki/List_of_largest_banks only highlighting this to show it's not a tiny random "weird" corner shop) requires to use either their mobile application or ItsMe (details https://fr.wikipedia.org/wiki/Itsme https://fr.wikipedia.org/wiki/Itsme if you want but basically also 2FA as a mobile app) in order to login to their consumer/professional website. You can from the mobile app scan a QR-code which in turn will ask for authentification, e.g. biometrics. Yes indeed registering the mobile application itself requires first another form of authentication, typically an SMS confirming the number plus a physical card with a physical card reader. You then input the resulting token in the app which validates it and then you don't need the card reader anymore while you rely on the mobile app. AFAICT the physical card reader options is not offered on some mobile payment options. I do not know if they are phasing it out of if it is because another method exists, namely if you have NOT registered their mobile application as a 2FA method, can you still use the physical card and card reader. I do not know that. To be clear they do NOT require an app per se. They do though if you want to use online services, including payments, bank transfer, reading specific kind of documents, adding specific recipients for recurring transfer, transfer above thresholds, etc. Hope it helps. If I missed something happy to try to clarify. Also FWIW and AFAICT it's getting more and more common for online services from bank in the EU.
drnick1 7mo ago
Then don't use those apps. I know it's easier said than done sometimes, but freedom is more important than convenience.
- deaux 7mo ago
  Yeah, just like, move to a country where banks still offer web banking, bro. Move banks. Got a locked down mortgage on good rates? Tough luck man. Etc
  - Hackbraten 7mo ago
    What are you trying to do with your mortgage using a mobile phone?
  - deleted 7mo ago
    [deleted]
MrDresden 7mo ago
You are badly informed. GrapheneOS has full support for Play Integrity[0]. [0]: https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...
- odo1242 7mo ago
  The link you link literally explains how GrapheneOS doesn’t support Play Integrity and apps should use the Hardware Attestation API instead.
  - microtonal 7mo ago
    I think you are both kind of wrong :). There are different Play Integrity levels. GrapheneOS passes the basic level, which is enough for many apps, including a bunch of European banking apps. GrapheneOS does not pass the strong level, which does remote attestation, but Google does not want to add the GrapheneOS signing key fingerprints. My European banking and credit card apps work fine on GrapheneOS because they don't require the strong integrity level. Google is using Play Integrity at the strong level to shut down competition. It's kinda ironic, since GrapheneOS is much more secure than the many phones out there with abysmal device security and slow updates that Google does accept with strong integrity.
  - MrDresden 7mo ago
    Yeah you're right, serves me right for writing that while busy doing other things this morning. The intent of the comment stands though. I meant to point out that GrapheneOS has perfectly good support for verifying device integrity via Hardware Attestation, just not the method which requires Google to acknowledge the OS signing keys.
gib444 7mo ago
"Terrible" is incorrect. Yes quite a few don't work but many many do . See: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/ https://privsec.dev/posts/android/banking-applications-compa...
lawn 7mo ago
All Swedish banking apps work without issue and many apps that use play integrity works well regardless. It's just some apps that use play integrity that in a certain way that doesn't work.
imhoguy 7mo ago
Then keep Google crapphone for banking purposes in your drawer, like auth scratch code cards in the past. I don't get that idea of carrying device with bank access in your pocket constantly. Moreover, at least in EU, there is more and more banks which publish their apps in non Google app stores too.
goda90 7mo ago
I've had multiple apps attempt to use Play Integrity on my GrapheneOS phone(it tells you when they try), and then just work anyway. Not sure why.

stavros 7mo ago

If they manage to expand their lineup a bit, that'll be my next phone. Or, if a company makes a phone with GrapheneOS preinstalled, I'm giving them my money. Fuck Google for doing this, and Play Integrity making me unable to use banks is even worse.

armadyl 7mo ago
They're actually partnering with Motorola and have phones coming out next year! It sounds like they'll be the Motorola Signature, Razr and Fold (iirc).
- stavros 7mo ago
  That's great news, thanks! I can keep my phone for another year.
utopiah 7mo ago
> if a company makes a phone with GrapheneOS preinstalled, I'm giving them my money. FWIW you can buy a Pixel (new or 2nd hand) and install GrapheneOS via the Web https://grapheneos.org/install/web https://grapheneos.org/install/web with nothing (genuinely nothing) installed on your computer and get it working in ~15min (depending on your connection to download the ROM) out of which maybe ~2min will be your interacting with the setup process. I initially bought an /e/OS precisely with your requirement, namely I "just" want a phone that works when I receive it, no tinkering, but having installed GrapheneOS myself few days (or weeks?) ago I can tell you, it's really straightforward.
- goda90 7mo ago
  > with nothing (genuinely nothing) installed on your computer Not 100% accurate. You need a browser that supports WebUSB[0] which are just Chromium based ones, not Safari or Firefox. [0]https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API https://developer.mozilla.org/en-US/docs/Web/API/WebUSB_API
  - 7mo ago

sneak 7mo ago

Used Graphene as a daily driver for a year. It’s an unserious toy.

yoavm 7mo ago
Can you elaborate? Why? I think many of us were hoping we could switch to it if/when Android becomes intolerable.
- microtonal 7mo ago
  I have no idea what they are talking about. I have been daily driving GrapheneOS for almost two months now (coming from iPhone, but I have tested Pixels and Samsung phones on the side for a while) and there is no material difference in daily use from running the stock Pixel OS in daily use if you install Play (Services) and a bunch of apps. Of course, it is more secure and comes with no crap pre-installed, which is nice. The only thing I have really found missing is Google Pay support for contactless payment (because Google doesn't want to allow GrapheneOS, but there are alternatives like Curve).
lawn 7mo ago
I'm using GrapheneOS as my daily driver you couldn't be more wrong.
uncognic 7mo ago
If it really was, you wouldn't have used it for a year

goodpoint 7mo ago

It's pretty crazy to trust such project to run your phone.