cross-posted from: https://slrpnk.net/post/15995282
Real unfortunate news for GrapheneOS users as Revolut has decided to ban the use of ‘non-google’ approved OSes. This is currently being posted about and updated by GrahpeneOS over at Bluesky for those who want to follow it more closely.
Edit: had to change the title, originally it said Uber too but I cannot find back to the source of ether that’s true or not…
I don’t think it’s a coincidence that the shittiest companies are those, who enforce Google’s broken and monopolistic “Play Integrity” API. Revolut has connections to Russia, McDonalds supports the Israeli genocide in Palestine and Authy has always just been a massive piece of shit, not even allowing users to export their TOTP seeds. These are three companies I would NEVER even consider using anyway.
And “Play Integrity” API actually does NOTHING, absolutely NOTHING for your security as an end user.
You use an outdated, unpatched Android version with multiple severe, publicly known exploits on an insecure device?
Google doesn’t give a single fuck.
You use the newest version of Android with all the patches applied on Google’s own hardware, with a locked boot loader and a hardened operating system?
That’s not allowed by the “Play Integrity” API.
It’s only purpose is to serve Google’s monopolistic business interests.I use McDonalds App all the time on GOS this only affect you if you use Google Pay when checking out to my knowledge.
Google has ruined Android by closing it up.
EU needs to step in and force Google to open it up.
While at it, go for Apple’s monopoly as well.
@Sunny
Gatekeeprs of wealth sticking together against the ambition for freedom of poorer people?
Oh, color me surprised. 🙄(I want to de-Google step by step, thanks for the heads up).
Small OT: In the article it’s mentioned also the app “IO” (italian for the english word “I”). There are also other important italian apps not working without play services. The serious thing is that that apps are almost mandatory to do the ordinary public administration bureaucracy. We can say that the italian state forces its citizens to use a smartphone with Google Play Services installed. This is no sense.
Oh great, I guess I’ll have to change my payment info for everything now. Fantastic.
I swear I am so close to jumping into the void of mainline linux on phones.
The only main issue is device drivers, but I would be fine happily extracting them from android or making new ones. Modern Android is a complete full stack POS.
Seems like my time to move away from Authy. Any drop in alternative for iOS? Ideally I could export services and load them back, not manually adding/removing 1 by 1. Even if I can’t though, suggestion still welcomed.
This is actually good, see it as an enrichment of your life. The only sad thing is Revolut though.
As an alternative to Authy I recommend Stratum (previously known as Authenticator Pro) https://apt.izzysoft.de/fdroid/index/apk/com.stratumauth.app
This due to its compatibility with Android wear (companion)
This makes me want to use GrapheneOS more. If the dataminers don’t want you to use it then it must be doing something right.
Too bad it only runs on Google’s phones…
It’s only officially supported on google phones because sadly those are the only ones that are not modified to fuck which makes installing and supporting other OS’es way too much work.
Giving google money once for a device is not a problem from a privacy or security standpoint.
That’s correct, but not the reason grapheneOS chooses only pixel phones. It’s the level of hardware security features.
Also unlockable and presumably has well working builds. It’s not just graphene, but just about every Android project it there that’s best supported on pixels. Other manufacturers have a crazy variety of locking schemes and required tools. Each one is a nightmare to support.
For GrapheneOS, it’s primarily that it’s re-lockable. That’s why other unlockable phones aren’t supported.
The GrapheneOS install process sets new OS signing keys so you can lock the phone again and get full verified boot. However, most manufacturers haven’t implemented this feature.
Yes, that cuts the list down even more.
What do you get, app/feature wise for verified boot vs. Play integrity app? Does it increase the amount of apps that work on it?
No, Play Integrity intentionally checks if it’s a Google-approved key. Android itself has an API to check verified boot and gives info on the signing key - most devs just want to know verified boot is working.
I feel Play Integrity has a short life ahead of if competition authorities realise how exactly it works. “Anti-competitive” is the first thing policy-minded folks think when I explain the API to them.
I would guess that it allows to detect tampering if you have to give your phone to the security officers and they do or don’t do something with it without you present. I heard of such occurrences on the border, but this happens in other places and countries, too. Not sure if locked bootloader would help, though
Second hand, no money for them
In the EU almost every phone has an unlockable bootloader, there just isn’t any roms or custom recoveries for a lot of them.
Wish they’d at least support Fairphone.
If Graphene reached out to them I bet Fairphone would even actively work with them to make it an official OS option.
Fairphone would need to substantially modify their hardware to make that work
Right? Have to pay google for the privilege
You can always buy a second hand one
Someone installing graphene os for security shouldn’t be trusting random second/third/etc hand hardware lol
There is absolutely no problem with that. The phone is wiped and encrypted when you flash graphene, and it does an integrity check every time it boots.
And you can even use the GrapheneOS Auditor app to perform a manual verification of the OS.
Hypothetically the hardware could have been modified, but that would take some insane level of a determined attacker to be fabricating modified pixels just to sell them on the used market.
Nothing too hypothetical nor an “insane” level of work. Didn’t Israel do just that with some beepers to blow up children?
Yes, this would only be a concern for targeted attacks by state actors, in which case not even buying new would be safe.
Thinking about it, in such a scenario buying used may even be safer
It also comes with a hardware auditor, although you need another trusted graphene phone to use it. I don’t know about the details, but sounds very hard to mess with it.
Shouldn’t trust anything then. They could intercept your new phone and modify it. They did it for switches. But your not worth it for “them”.
Your options are:
Apple phone
Bloated android phone like Samsung etc.
Chinese android phone (xiami etc)
Google phone with Android
Google phone with graphene. This still looks like the best of those options.
Or no phone? I guess people are hardcore enough that will be the option.
Edit: I stand corrected.
Fairphone? Swiftphone? eOS? Linuxphone? PostmarketOS etc?
All of these are insecure as hell. Linux phones especially https://madaidans-insecurities.github.io/linux-phones.html
Fairphone also really fucked up: They signed their own OS with the publicly available (!) AOSP test signing keys. These guys really don’t know that they’re doing, and I would trust their hardware or software whatsoever. And no, installing a custom ROM doesn’t solve this. Considering how bad their security practices are, we genuinely have to assume that there are security issues with the device firmware as well.
/e/OS is based on the already insecure LineageOS, and it weakens the security further, so it’s not a good option either.
None of the options you mentioned can be compared to GrapheneOS. It’s currently the best option if you value your privacy and security. You don’t have to give Google money either, since you can just buy a used device, which is also cheaper and more environmentally friendly. Google also makes repairing their devices pretty easy for consumers and even works with iFixit. Here’s a Mastodon post I recently saw about that: https://social.linux.pizza/@midtsveen/113630773097519792
An used Pixel, assuming I can find one in my country, still costs four (4) times what I need to shell out for a in-market Lineage compatible phone.
Theoretical security is cute, but it has to be adjusted to practical feasibility. The most secure computer in the world is useless to you if you can’t boot it up.
Security-wise you’re better off using whatever OS comes with your device (as long as it gets updates) than downgrading to LineageOS. At least most smartphone vendors (except for Fairphone) manage to ship their Stock OS with a locked bootloader and somewhat working Verified Boot.
Is swiftphone its own thing or did you mean shiftphone? I kinda want the shiftphone 8 myself even if they only ship to neighboring countries of mine.
Ah sorry, you’re right. I meant shiftphone.
There’s always package forwarding. I’m about to find out how bad an idea that is.
I use cheap motorola phone with lineage OS, add that to your options
I don’t think LOS has any privacy/security improvements over the stock android?
(IIRC) it’s even worse than stock because you can’t lock the bootloader after installation.
Though if your phone isn’t getting official updates, it’s probably safer with LOS.
Yup, it’s definitely worse https://madaidans-insecurities.github.io/android.html#lineageos
(IIRC) it’s even worse than stock because you can’t lock the bootloader after installation.
That’s a problem with the phone manufacturer, not with Lineage.
LineageOS itself drastically weakens security even compared to stock AOSP, for example by exposing root access or deploying insecure SELinux policies
There’s also the Lineage-based DivestOS that attempts to keep up with more security updates, and relocking the bootloader in phones that support it.
Yeah, I myself am using CalyxOS, because DivestOS doesn’t support the Fairphone 5 unfortunately. CalyxOS also has relocking.
Physical access is game over anyway?
Not with GrapheneOS, since you can entirely disable the USB controller from the settings on a driver level, making it impossible to connect the phone to a forensic data extraction device. GrapheneOS also has a convenient auto-reboot feature, which (together with their patches to the Linux kernel and Fastboot recovery OS to include memory zeroing) erases the encryption keys from memory, putting the device in BFU state and requiring the PIN/password to unlock. This is additionally secured by the Titan M2 secure element, which makes use of the Weaver API and drastically throttles brute-force unlock attempts. https://grapheneos.org/faq#encryption
Xiaomi has the biggest custom ROM scene out there btw despite them trying their hardest to stop bootloader unlocking. You really don’t need to have a company supporting unlocking to make ROMs for them. If they outright block it then that’s an issue.
I read somewhere that on some xiaomi phones in china you need to request it, https://github.com/melontini/bootloader-unlock-wall-of-shame/blob/main/brands/xiaomi/README.md
My friend just got a new Xiaomi phone. He tried unlocking it a few days ago and got “try again in 168 hours”. That happened in Europe. It’s an absolute mess nowadays, I remember when they started blocking you from unlocking the bootloader. First you had to wait 24 hours, then 3 days, now it’s an entire week. You also need to make sure you’re logged into your Mi Account on both phone and PC and do even more weird fuckery to ensure the process actually go through. Meanwhile, on GOOGLE Pixel devices you just type one command after you enable oem unlocking in settings and reboot into fastboot mode. Crazy.
This is very bad news, because this means any app that wants your data could do the same.
On the other hand, it makes it easy to find which apps aren’t to be trusted with your data.
Also very obvious when an app or website have an US and an EU version. You just know they buttfuck the Americans because no rules.
Even Apple had to make two versions of iOS.
Maybe graphene will find a way into duping those apps to think you have a regular android phone?
Err, you could firewall an app from your data in Private Space or Shelter for older Android versions. That should work on any Android device.
Fuck both of these companies. Never used McDicks app in the first place. Spyware bullshit.
The mcdonalds app is a scam to get you to agree to their arbitration clause
Care to elaborate? I’m curious.
Never mind. I found an article pretty quick. Thanks for the heads up anyway. :)
Funny that news nowadays is citing tik tok and reddit comments
https://www.thedailymeal.com/1431937/mcdonalds-app-terms-waive-rights-trial/
I can’t tell you how frustrating it is to not only be subjected to Fox
EntertainmentNews by my family, but to be subjected to their social media segments every 5 minutes (not exaggerating).It feels like when I find those ancient newspaper articles about how so-and-so moved in with her boyfriend before their wedding night or whatever.
Some things never change I guess.
Can you share with the class? (Shit service where I’m at D:)
I dont buy mcdogwater anymore but im interested
https://www.mashed.com/1432093/mcdonalds-new-app-terms-conditions-reactions/
They gave away free chips in exchange of you downloading their app and accepting their shitty conditions.
Odd timing considering I’ve banned McDonalds, Revolut and Authy from my phone.
Just to be clear, they banned all custom roms, not only graphene.
It’s crazy how they can just do illegal things because they have so much money…
Do I own my phone or not??
Most ROMs like LineageOS and CalyxOS drastically weaken the security of Android, so that would actually make sense. GrapheneOS has far better security than AOSP, the Stock Pixel OS, or basically every other version of Android that you would find pre-loaded on a device. https://grapheneos.org/features#exploit-protection
Most ROMs like LineageOS and CalyxOS drastically weaken the security of Android
Source?
Graphene shills have been banging on this point for donkey’s ages. Reality is that many people use phones that are out of OEM support and many OEM ROMs are bundled with questionable software (Oppo, Samsung etc.) There are some decent criticisms to be made about LineageOS, but others to be made about Grapheme, like its Google-suggestive configurations, which is quite bad for security and privacy. Graphene says this is all optional and not part of the OS, but doesn’t include any equivalent F-Droid installer.
Yeah. As much as I love GrapheneOS and all the security work, sometimes I feel like their “ideal” setup is to just install GrapheneOS on the latest Pixel phone and use only the 5 or so built in apps, as everything else is insecure, brings additional code baggage and can introduce flaws. I don’t think anyone can live like that.
McDonalds? Uber?
They both have fully functioning webapps btw.
Right people who install various apps like McDonalds apps etc, are these even typical to GrapheneOS users? I’d think most would avoid superfluous data stealing apps.
I’ve been thinking of switching the GrapheneOS. I certainly enjoy my privacy, and are taking steps to move to sources that don’t harvest my data. Outside of YouTube and android I’ve completely degoogled myself, even replaced Maps with magic earth and OsmAnd. I even swapped full time to linux a handful of months ago as a gamer with a VR interest. But I’m not so hardcore to not use any service that might sell my data. I still use vanilla firefox, food ordering apps, and discord for example. So while I’m not someone who goes to extreme lengths to protect my data, moving over to GrapheneOS doesn’t seem like a huge inconvenience compared to the gains you get.
I switched to grapheneos on pixel 9 straight from iPhone. The only reason I have any google stuff on the phone is because of RCS messaging. There is literally nothing I have any issues with on this phone, software or hardware. It has been a very smooth and comfortable transition. I very much recommend giving it a try. I think you’d be surprised how little google (exclusively) gives, compared to how much they take.
Trackers I need find my to work. Well at least not spam everyone with a tracker is following you when my phone is also traveling with them.
If you already don’t use Google apps, and your bank app doesn’t ban graphene, there shouldn’t be any issues at all tbh
You can use this website to check if your banking app is supported: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
Sorry but it seems I might have been mistaken by calling out Uber on this one. Thought i read about Uber during this but I cant find back to it. Have changed the title.
It happens! And that list surely isn’t comprehensive.
I’ve been nagging my bank’s support to add the Graphene’s signatures, for example, no luck so far 😞
Do you mind sharing which bank you use?
Sofi
What do you mean webapp? Isn’t the app that you install a webapp? And isn’t a website not an app because you dont install it?
PWA - Portable Web App, Apple was going to make this the primary way to run apps but then decided an app store and private stuff was more profit and their support for it tends to be on the suckier side, but has gotten better over the years. You install a PWA in your browser by either “Install” or “Add to home screen” or something like that depending on browser and device being used.
by webapps they mean browser based apps.
Apparently not. I guess some apps you install in the browser. Which is an important distinction, if they’re using the word correctly
Yes both are PWA capable. However I stand corrected. The McDonalds webapp now redirects you to the play store when you try to order.
Guess they don’t want me as a customer. (Not that I’d eat McDonalds anyway).
riders.uber.com is fully functional though, I use it often
Try changing your mobile browser’s user agent to desktop
good point.
