KurtKurt@chaos.social
Oct 9, 2024, 7:17 AM@GrapheneOS long story short: you don't have a solution for the banking issue. @normplum @gloopsies
Replies
GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 7:48 AM@Kurt @normplum @gloopsies Banking apps work fine on GrapheneOS. Some require the per-app exploit protection compatibility mode. Only banking apps which require a Google certified OS are unavailable. That's a clear choice by those banks to disallow using GrapheneOS or any other non-Google-certified OS to use their apps at all or use certain functionality in their apps. it's not a problem created by GrapheneOS and requires a non-technical solution since spoofing is only a very short term bypass.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 7:54 AM
@Kurt @normplum @gloopsies If someone MUST have Google Pay and wants to use GrapheneOS, there's the option to use a Pixel Watch or Galaxy Watch for it instead of a whole secondary phone. Pixel Watch technically supports using another OS but we have little interest in supporting it and it would lose Google Pay due to the same anti-competitive Play Integrity API pretend security feature. They allow using a device with no patches for 10 years, so clearly it's not actually about real security.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 7:56 AM
@Kurt @normplum @gloopsies Google Pay was designed in a way that's less secure than Apple Pay in order to have it working across all Android devices instead of only initially working on Pixels and then expanding it to other devices by having them add hardware support for it in their trusted execution environment or secure element. To provide some semblance of it not being a major security and fraud risk they used the Play Integrity API to weakly validate a device is has a Google certified OS.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 7:59 AM
@Kurt @normplum @gloopsies The weak Play Integrity API integrity level is easily spoofed on a case-by-case basis, but it would be easy for them to repeatedly block and therefore totally unacceptable for a production OS. Spoofing weak integrity level required by Google Pay requires pretending to be a device without hardware attestation which is easy for them to detect with fingerprinting with delayed enforcement. They'll require a stronger integrity level at some point. Spoofing doesn't fix it.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 8:01 AM
@Kurt @normplum @gloopsies There is no viable technical solution to apps trying to disallow using GrapheneOS or any other non-Google-certified-OS. The solution has to be forbidding this at a regulatory level or at least legal victories against the companies enabling and promoting it (Google). The best solution is regulation. Google should not be allowed to block using an alternate OS or encourage others to do it because that's highly anti-competitive and reinforces their monopolies.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 8:02 AM
@Kurt @normplum @gloopsies Google should absolutely not be allowed to interfere with providing full Android app compatibility with the Play Integrity API anymore. Urgent regulatory action is needed around the world before they further cripple app compatibility in Android compatible operating systems with this. That is not something we can do, only something we can advocate for, and we do. We're in contact with the EU Commission about it for around a year already. They move slowly...
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 8:03 AM
@Kurt @normplum @gloopsies Google is also misleading regulators about this by presenting anti-competitive as security features despite it clearly having no actual substance for security. So far, their approach is succeeding at reducing app compatibility while not having any antitrust actions taken against them over it yet. That's unlikely to continue because it's such a blatant anti-competitive action without real security value.
Patryk MiśPatrykMis@infosec.exchangeOct 9, 2024, 8:44 AM@GrapheneOS @Kurt @normplum @gloopsies Can we, user do something in this matter by e.g. writing a letter to increase importance in their eyes?
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 9:00 AM
@PatrykMis @Kurt @normplum @gloopsies Yes, but we aren't sure on the best way to do it. We're in active communication with the EU Commission and with a couple companies interested in helping with either pressure the EU Commission or take legal action with a lawsuit. It would be too hard to do it on our own but we have help and need more.
- KurtKurt@chaos.socialOct 9, 2024, 10:21 AM
@GrapheneOS how can it be illegal for Google to provide information about the device condition. Or app developers to use that information for decision about provided services. Maybe OS makers should start to provide own integrity attestation api. So an apps can hold lists with trusted OS. @PatrykMis @normplum @gloopsies
- Gloopsies :fedora:gloopsies@fosstodon.orgOct 9, 2024, 10:26 AM
@Kurt @GrapheneOS @PatrykMis @normplum
The problem this makes is that Google enforces its monopoly over the whole Android ecosystem and blocks anyone else from making a ROM with working apps. The European union is fighting hard against cases like this and there is a great precedent for it to be illegal
There is a hardware attestation API that can be used by any Android based custom ROMs that follows best security practices and that is probably more secure to use than Google's proprietary APIs
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 10:31 AM
@gloopsies @Kurt @PatrykMis @normplum It's still not good for apps to use the hardware attestation API for permitting only the stock OS and specific alternate operating systems. It's still a horrible approach. It's what we recommend as an alternative to disallow using alternate operating systems entirely because they can do this without losing anything they think they're getting from doing this check.
https://grapheneos.org/articles/attestation-compatibility-guide explains how to allow GrapheneOS while still doing a misguiding thing.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 10:32 AM
@gloopsies @Kurt @PatrykMis @normplum The only case where this kind of thing actually makes sense is a basic anti-cheat system for a game. It has no value for trying to stop people recording what's in an app. It has no value for security. It's at best a way to add basic anti-cheat to a game. That is one actually valid case but it doesn't mean cheating isn't possible, just that it would require custom hardware or a bypass for hardware attestation via a leaked key or TEE / secure element exploit.
- GrapheneOSGrapheneOS@grapheneos.socialOct 9, 2024, 10:28 AM
@Kurt @PatrykMis @normplum @gloopsies Multiple countries have already found Google's device certification rules and system to be illegal anti-competitive behavior and this is directly based on it. How can it be legal?
It is clearly breaking competition laws for Google to mark GrapheneOS as not being secure when they're completely capable of verifying it via hardware attestation. It provides far better security than the stock OS. They're allowing operating systems with no patches for years.