3 ms·
IMO the most annoying thing is that Google could solve this problem today by just adding the GrapheneOS signing keys to the whitelisted keys. Instead they decid
by microtonal 2mo ago
IMO the most annoying thing is that Google could solve this problem today by just adding the GrapheneOS signing keys to the whitelisted keys. Instead they decide to exclude GrapheneOS because security, while attesting phones that are still on Android 13 (multiple years without fixes for vulnerabilities that are not marked high/critical) and did not apply ASB patches for up to 12 months.
A first step would be requiring Google to attest all devices that have a locked bootloader, verified boot, signed with non-public keys, and have a recent Android version and patch level.
IMO they should also boot anything older than Android 16 and behind more than 1-2 ASBs, if security is the real reason to have Play Integrity remote attestation.
- inigyou 2mo agoPOSIWID: the purpose of remote attestation is to force people to buy devices that pay Google license fees.
- gruez 2mo ago>that pay Google license fees Source? I thought it was free for OEMs?
- inigyou 2mo agoI think there's a fee and also a long list of requirements - such as you must not sell any phone without Google Play Store.
- gruez 2mo ago>I think there's a fee Seems to be only in the EU (because they're being forced to), and some other sources say google is offsetting the fee through revenue sharing back to the OEMs. In any case the original claim of "the purpose of remote attestation is to force people to buy devices that pay Google license fees" is questionable given that google had to be forced into charging money for it. https://www.theverge.com/2018/10/19/17999366/google-eu-android-licensing-terms https://www.theverge.com/2018/10/19/17999366/google-eu-andro...