5 ms·
Why would anyone who cares enough about security/privacy to run a de-googled phone want to use a tap to pay app?
by giantg2 2mo ago
Why would anyone who cares enough about security/privacy to run a de-googled phone want to use a tap to pay app?
- podgietaru 2mo agoBecause it’s convenient?
- inigyou 2mo agoI agree, it's very convenient to have a phone full of corporate malware. But I thought the point of GrapheneOS was to escape that. My corporate malware only runs on my secure card processor which sits in a pocket glued to my phone.
- stavros 2mo agoYou're begging the question. The entire premise of this thread is "we should be able to pay without infesting our phone with corporate malware".
- inigyou 2mo agoWell yes, but attacking Graphene for that is attacking the wrong layer. If you want an open payments system the government has to mandate it, or you could take the low chance of success with the free market competition method.
- stavros 2mo agoI read the very first message of the thread as "if you're going to regulate something, regulate that we should be able to pay without requiring Google", ie with Graphene and the like. I didn't read it as an attack on Graphene.
- microtonal 2mo agoIMO the most annoying thing is that Google could solve this problem today by just adding the GrapheneOS signing keys to the whitelisted keys. Instead they decide to exclude GrapheneOS because security, while attesting phones that are still on Android 13 (multiple years without fixes for vulnerabilities that are not marked high/critical) and did not apply ASB patches for up to 12 months. A first step would be requiring Google to attest all devices that have a locked bootloader, verified boot, signed with non-public keys, and have a recent Android version and patch level. IMO they should also boot anything older than Android 16 and behind more than 1-2 ASBs, if security is the real reason to have Play Integrity remote attestation.
- inigyou 2mo agoPOSIWID: the purpose of remote attestation is to force people to buy devices that pay Google license fees.
- gruez 2mo ago>that pay Google license fees Source? I thought it was free for OEMs?
- inigyou 2mo agoI think there's a fee and also a long list of requirements - such as you must not sell any phone without Google Play Store.
- gruez 2mo ago>I think there's a fee Seems to be only in the EU (because they're being forced to), and some other sources say google is offsetting the fee through revenue sharing back to the OEMs. In any case the original claim of "the purpose of remote attestation is to force people to buy devices that pay Google license fees" is questionable given that google had to be forced into charging money for it. https://www.theverge.com/2018/10/19/17999366/google-eu-android-licensing-terms https://www.theverge.com/2018/10/19/17999366/google-eu-andro...
- miroljub 2mo agoThe very moment it becomes possible to create a Google Pay alternative, there will be at least a dozen choices, some of them fully open source and privacy conserving. The only reason why we don’t have them is Google / Apple duopoly.
- inigyou 2mo agoIt's possible right now, but you have to (as Google did) convince all banks, merchants, and card networks to let them use your system.
- andrewshadura 2mo agoMerchants and card networks don't need to be convinced. From their PoV Google Pay device is just a regular payment card.
- kelnos 2mo agoI seriously doubt that. There used to be more NFC payment apps, but most banks abandoned them since it was cheaper to just pay Google their cut through Google Pay. Or Wallet, or whatever the hell they renamed it to. Banks letting an open source project run transactions through them... that's... hilarious.
- microtonal 2mo agoBut I thought the point of GrapheneOS was to escape that. I think the point of GrapheneOS is being as secure as possible first and within those parameters give people the choice how much of Google they want. They have implemented sandboxed Google Play Services for a reason. Many people need Play Services for practical reasons (e.g. because they need to run apps that require it), so let's then run it in the most secure/private way possible - make it a sandboxed app, allowing users to decide whether to install it or not and if they choose to, that they can assign/revoke permissions like any other Android app.
- Shish2k 2mo agoSome people like to have choices other than "all" and "nothing"
- microtonal 2mo agoPeople use alternatives for many different reasons (or multiple at the same time): - They might want privacy from Google. Using Google Pay probably doesn't make much sense. - Security protection against Google. Google can remotely brick devices with unsandboxed Play Services. After blocking of ICC officials and all the Greenland threats, it's not odd that some European citizens would like to block this Google/US government attack vector. - They want a clean phone without all kinds of crap like Gemini preinstalled. - They want to reduce dependence on big tech/Google product in general. In cases 2-4, using Google Pay with sandboxed Google Play services may be an acceptable compromise for convenience.
- xethos 2mo agoMinor note, you forgot battery life. Pinging your location every other minute for traffic and crowd denisty for Google Maps, even using AGPS, isn't cheap. When you find battery life randomly tanks for a few days, despite not changing anything in your life, it's always Google Play Services that end up being the culprit
- microtonal 2mo agoGreat point! For me that was not a reason to get a phone with GrapheneOS, but definitely a noticeable/welcome side-effect.
- giantg2 2mo agoIs this an AI response? I get why people want a de-googled phone. What I don't get is why they would want to use tap to pay, one of the payment methods with increased attack vectors.
- microtonal 2mo agoIs this an AI response? No. I hate AI writing, so I never use AI for writing. Randomly throwing in accusations in discussions sucks. I don't think my comment had any of the hallmarks of AI writing either, unless bulleted lists are also not-done these days. I guess I should be happy that people don't recognize me as a non-native speaker anymore?
- collabs 2mo agoWithout Google doesn't mean the same thing for everyone. I got a Motorola g moto stylus 2025 and have been running an experiment for almost a year now in which I use this device without ever logging into the device with a Google account. Fdroid and obtainium work flawlessly. Aurora Store works for the most part but some apps won't even let me open them without a play store signed in account which is sad.
- estimator7292 2mo agoWhy can't I use my bank's app, which I presumably already trust, to tap-to-pay? Why should there be a third party involved at all?
- kelnos 2mo agoBecause people have different priorities than you do, and just because you can't imagine something, it doesn't mean it's not real or reasonable.
- shiandow 2mo agoWell it's going to be a matter of time anyway, I'm already forced to use an app when I'd rather not. But more than that I want to have a choice.
- realusername 2mo agoBecause tap to pay has nothing to do with Google? Some people just want a phone without the duopoly and nothing else.
- armadyl 2mo agoTap to pay apps, if the developer is trustworthy or if it’s from your bank, are significantly more secure than even carrying a physical card around as your payment is now locked behind biometrics/a pin. Also de-googling isn’t the point of GrapheneOS.
- amluto 2mo agoHow about a way to use contactless payments on, say, a Pebble watch?
- ValdikSS 2mo agoXiaomi Mi Band 6 and 7 support NFC card emulation for payments, issued by Visa/MC.
- HDBaseT 2mo agoBecause privacy isn't represented as a binary. You don't live life only having privacy or not having privacy. You fall somewhere in the middle. You can shift your overall privacy posture up if you de-google, even one service at a time. Uninstalling Google Maps, whilst still using Gmail has privacy benefits. Each step improves your privacy. Some opt for convenience over privacy, you can pick and choose services to use whilst still retaining decent privacy.