Revolut, McDonald's, and Authy have banned the use of GrapheneOS.
cross-posted from: https://slrpnk.net/post/15995282
Real unfortunate news for GrapheneOS users as Revolut has decided to ban the use of 'non-google' approved OSes. This is currently being posted about and updated by GrahpeneOS over at Bluesky for those who want to follow it more closely.
Edit: had to change the title, originally it said Uber too but I cannot find back to the source of ether that's true or not..
https://grapheneos.org/articles/attestation-compatibility-guideOpen linkView original on slrpnk.net792
Comments327
This makes me want to use GrapheneOS more. If the dataminers don't want you to use it then it must be doing something right.
Too bad it only runs on Google's phones...
It's only officially supported on google phones because sadly those are the only ones that are not modified to fuck which makes installing and supporting other OS'es way too much work.
Giving google money once for a device is not a problem from a privacy or security standpoint.
That's correct, but not the reason grapheneOS chooses only pixel phones. It's the level of hardware security features.
Also unlockable and presumably has well working builds. It's not just graphene, but just about every Android project it there that's best supported on pixels. Other manufacturers have a crazy variety of locking schemes and required tools. Each one is a nightmare to support.
For GrapheneOS, it's primarily that it's re-lockable. That's why other unlockable phones aren't supported.
The GrapheneOS install process sets new OS signing keys so you can lock the phone again and get full verified boot. However, most manufacturers haven't implemented this feature.
Yes, that cuts the list down even more.
What do you get, app/feature wise for verified boot vs. Play integrity app? Does it increase the amount of apps that work on it?
No, Play Integrity intentionally checks if it's a Google-approved key. Android itself has an API to check verified boot and gives info on the signing key - most devs just want to know verified boot is working.
I feel Play Integrity has a short life ahead of if competition authorities realise how exactly it works. "Anti-competitive" is the first thing policy-minded folks think when I explain the API to them.
I would guess that it allows to detect tampering if you have to give your phone to the security officers and they do or don't do something with it without you present. I heard of such occurrences on the border, but this happens in other places and countries, too. Not sure if locked bootloader would help, though
Second hand, no money for them
In the EU almost every phone has an unlockable bootloader, there just isn't any roms or custom recoveries for a lot of them.
Wish they'd at least support Fairphone.
If Graphene reached out to them I bet Fairphone would even actively work with them to make it an official OS option.
Fairphone would need to substantially modify their hardware to make that work
Right? Have to pay google for the privilege
You can always buy a second hand one
Someone installing graphene os for security shouldn't be trusting random second/third/etc hand hardware lol
There is absolutely no problem with that. The phone is wiped and encrypted when you flash graphene, and it does an integrity check every time it boots.
Hypothetically the hardware could have been modified, but that would take some insane level of a determined attacker to be fabricating modified pixels just to sell them on the used market.
Yes, this would only be a concern for targeted attacks by state actors, in which case not even buying new would be safe.
Thinking about it, in such a scenario buying used may even be safer
It also comes with a hardware auditor, although you need another trusted graphene phone to use it. I don't know about the details, but sounds very hard to mess with it.
Nothing too hypothetical nor an "insane" level of work. Didn't Israel do just that with some beepers to blow up children?
And you can even use the GrapheneOS Auditor app to perform a manual verification of the OS.
Shouldn't trust anything then. They could intercept your new phone and modify it. They did it for switches. But your not worth it for "them".
Your options are:
Apple phone
Bloated android phone like Samsung etc.
Chinese android phone (xiami etc)
Google phone with Android
Google phone with graphene. This still looks like the best of those options.
Or no phone? I guess people are hardcore enough that will be the option.
Edit: I stand corrected.
Fairphone? Swiftphone? eOS? Linuxphone? PostmarketOS etc?
Is swiftphone its own thing or did you mean shiftphone? I kinda want the shiftphone 8 myself even if they only ship to neighboring countries of mine.
Ah sorry, you're right. I meant shiftphone.
There's always package forwarding. I'm about to find out how bad an idea that is.
All of these are insecure as hell. Linux phones especially https://madaidans-insecurities.github.io/linux-phones.html
Fairphone also really fucked up: They signed their own OS with the publicly available (!) AOSP test signing keys. These guys really don't know that they're doing, and I would trust their hardware or software whatsoever. And no, installing a custom ROM doesn't solve this. Considering how bad their security practices are, we genuinely have to assume that there are security issues with the device firmware as well.
/e/OS is based on the already insecure LineageOS, and it weakens the security further, so it's not a good option either.
None of the options you mentioned can be compared to GrapheneOS. It's currently the best option if you value your privacy and security. You don't have to give Google money either, since you can just buy a used device, which is also cheaper and more environmentally friendly. Google also makes repairing their devices pretty easy for consumers and even works with iFixit. Here's a Mastodon post I recently saw about that: https://social.linux.pizza/@midtsveen/113630773097519792
An used Pixel, assuming I can find one in my country, still costs four (4) times what I need to shell out for a in-market Lineage compatible phone.
Theoretical security is cute, but it has to be adjusted to practical feasibility. The most secure computer in the world is useless to you if you can't boot it up.
Security-wise you're better off using whatever OS comes with your device (as long as it gets updates) than downgrading to LineageOS. At least most smartphone vendors (except for Fairphone) manage to ship their Stock OS with a locked bootloader and somewhat working Verified Boot.
I use cheap motorola phone with lineage OS, add that to your options
I don't think LOS has any privacy/security improvements over the stock android?
(IIRC) it's even worse than stock because you can't lock the bootloader after installation.
Though if your phone isn't getting official updates, it's probably safer with LOS.
There's also the Lineage-based DivestOS that attempts to keep up with more security updates, and relocking the bootloader in phones that support it.
https://divestos.org/
Yeah, I myself am using CalyxOS, because DivestOS doesn't support the Fairphone 5 unfortunately. CalyxOS also has relocking.
That's a problem with the phone manufacturer, not with Lineage.
LineageOS itself drastically weakens security even compared to stock AOSP, for example by exposing root access or deploying insecure SELinux policies
Physical access is game over anyway?
Not with GrapheneOS, since you can entirely disable the USB controller from the settings on a driver level, making it impossible to connect the phone to a forensic data extraction device. GrapheneOS also has a convenient auto-reboot feature, which (together with their patches to the Linux kernel and Fastboot recovery OS to include memory zeroing) erases the encryption keys from memory, putting the device in BFU state and requiring the PIN/password to unlock. This is additionally secured by the Titan M2 secure element, which makes use of the Weaver API and drastically throttles brute-force unlock attempts. https://grapheneos.org/faq#encryption
Yup, it's definitely worse https://madaidans-insecurities.github.io/android.html#lineageos
Xiaomi has the biggest custom ROM scene out there btw despite them trying their hardest to stop bootloader unlocking. You really don't need to have a company supporting unlocking to make ROMs for them. If they outright block it then that's an issue.
I read somewhere that on some xiaomi phones in china you need to request it, https://github.com/melontini/bootloader-unlock-wall-of-shame/blob/main/brands/xiaomi/README.md
My friend just got a new Xiaomi phone. He tried unlocking it a few days ago and got "try again in 168 hours". That happened in Europe. It's an absolute mess nowadays, I remember when they started blocking you from unlocking the bootloader. First you had to wait 24 hours, then 3 days, now it's an entire week. You also need to make sure you're logged into your Mi Account on both phone and PC and do even more weird fuckery to ensure the process actually go through. Meanwhile, on GOOGLE Pixel devices you just type one command after you enable oem unlocking in settings and reboot into fastboot mode. Crazy.
This is very bad news, because this means any app that wants your data could do the same.
On the other hand, it makes it easy to find which apps aren't to be trusted with your data.
Also very obvious when an app or website have an US and an EU version. You just know they buttfuck the Americans because no rules.
Even Apple had to make two versions of iOS.
Maybe graphene will find a way into duping those apps to think you have a regular android phone?
Err, you could firewall an app from your data in Private Space or Shelter for older Android versions. That should work on any Android device.
Fuck both of these companies. Never used McDicks app in the first place. Spyware bullshit.
The mcdonalds app is a scam to get you to agree to their arbitration clause
Care to elaborate? I'm curious.
Never mind. I found an article pretty quick. Thanks for the heads up anyway. :)
Funny that news nowadays is citing tik tok and reddit comments
https://www.thedailymeal.com/1431937/mcdonalds-app-terms-waive-rights-trial/
I can't tell you how frustrating it is to not only be subjected to Fox
EntertainmentNews by my family, but to be subjected to their social media segments every 5 minutes (not exaggerating).It feels like when I find those ancient newspaper articles about how so-and-so moved in with her boyfriend before their wedding night or whatever.
Some things never change I guess.
Odd timing considering I've banned McDonalds, Revolut and Authy from my phone.
McDonalds? Uber?
They both have fully functioning webapps btw.
Right people who install various apps like McDonalds apps etc, are these even typical to GrapheneOS users? I'd think most would avoid superfluous data stealing apps.
I've been thinking of switching the GrapheneOS. I certainly enjoy my privacy, and are taking steps to move to sources that don't harvest my data. Outside of YouTube and android I've completely degoogled myself, even replaced Maps with magic earth and OsmAnd. I even swapped full time to linux a handful of months ago as a gamer with a VR interest. But I'm not so hardcore to not use any service that might sell my data. I still use vanilla firefox, food ordering apps, and discord for example. So while I'm not someone who goes to extreme lengths to protect my data, moving over to GrapheneOS doesn't seem like a huge inconvenience compared to the gains you get.
I switched to grapheneos on pixel 9 straight from iPhone. The only reason I have any google stuff on the phone is because of RCS messaging. There is literally nothing I have any issues with on this phone, software or hardware. It has been a very smooth and comfortable transition. I very much recommend giving it a try. I think you'd be surprised how little google (exclusively) gives, compared to how much they take.
Trackers I need find my to work. Well at least not spam everyone with a tracker is following you when my phone is also traveling with them.
If you already don't use Google apps, and your bank app doesn't ban graphene, there shouldn't be any issues at all tbh
You can use this website to check if your banking app is supported: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
@[email protected]
Sorry but it seems I might have been mistaken by calling out Uber on this one. Thought i read about Uber during this but I cant find back to it. Have changed the title.
It happens! And that list surely isn't comprehensive.
I've been nagging my bank's support to add the Graphene's signatures, for example, no luck so far 😞
Do you mind sharing which bank you use?
Sofi
What do you mean webapp? Isn't the app that you install a webapp? And isn't a website not an app because you dont install it?
PWA - Portable Web App, Apple was going to make this the primary way to run apps but then decided an app store and private stuff was more profit and their support for it tends to be on the suckier side, but has gotten better over the years. You install a PWA in your browser by either "Install" or "Add to home screen" or something like that depending on browser and device being used.
by webapps they mean browser based apps.
Apparently not. I guess some apps you install in the browser. Which is an important distinction, if they're using the word correctly
Yes both are PWA capable. However I stand corrected. The McDonalds webapp now redirects you to the play store when you try to order.
Guess they don't want me as a customer. (Not that I'd eat McDonalds anyway).
riders.uber.com is fully functional though, I use it often
Try changing your mobile browser's user agent to desktop
good point.
Just to be clear, they banned all custom roms, not only graphene.
It's crazy how they can just do illegal things because they have so much money...
Do I own my phone or not??
Most ROMs like LineageOS and CalyxOS drastically weaken the security of Android, so that would actually make sense. GrapheneOS has far better security than AOSP, the Stock Pixel OS, or basically every other version of Android that you would find pre-loaded on a device. https://grapheneos.org/features#exploit-protection
Source?
Graphene shills have been banging on this point for donkey's ages. Reality is that many people use phones that are out of OEM support and many OEM ROMs are bundled with questionable software (Oppo, Samsung etc.) There are some decent criticisms to be made about LineageOS, but others to be made about Grapheme, like its Google-suggestive configurations, which is quite bad for security and privacy. Graphene says this is all optional and not part of the OS, but doesn't include any equivalent F-Droid installer.
Yeah. As much as I love GrapheneOS and all the security work, sometimes I feel like their "ideal" setup is to just install GrapheneOS on the latest Pixel phone and use only the 5 or so built in apps, as everything else is insecure, brings additional code baggage and can introduce flaws. I don't think anyone can live like that.
the problem here is not the banks or apps, the problem is Google Play Integrity API, which is supposed to enforce to run apps in secured phones and it is used to ban secured ROMs such as GrapheneOS and it allows to run apps on outdated phones without security patches.
The point of the Google Play Integrity API is to ensure that the user is not in control of their phone, but that one of a small number of megacorps are in control.
Can the user pull their data out of apps? Not acceptable. Can the user access the app file itself? Not acceptable. Can the user modify apps? Not acceptable.
Basically it ensures that the user has no control over their own computing.
It's simply the "secure" isn't meant for users but the cooperations. Make it "secure" to their business.
It's used to help secure the businesses app yes. It helps with things like preventing resource abuse which would cost the company money. E.g. querying mass amounts of data on a loop to increase the companies bill.
If you install GrapheneOS, you do not need root, so GrapheneOS is in control of the phone not the user. The key here is if GrapheneOS is secure enough to be certified by Google Play Integrity API. is it security or other issue? perhaps Google is not supporter of FOSS ROMs, perhaps it is not fun of how GrapheneOS removes permissions to Google Apps, ...
If it is not security, this is a kind of monopoly to control which ROMs are allowed to run apps.
This is possible on any Android phone, no root or custom rom required
So that's why it works on lineage? They seem to get around this somehow
It runs in Lineage? Lineage is certified by Google Play Integrity API (I doubt it)? or Lineage tricks Google Play Integrity API?
Yes. These apps work and bank apps work fine. Netflix works too.
There are only problems with a bunch of applications that recently decided to use Play Integrity API not with every banking app nor Netflix.
This is the list: https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos
In fact those applications should not work with Lineage unless Play Integrity API is patched/cracked someway in Lineage.
Authy in that list works fine too
Oh, the banks and regulators are to blame. Especially in Europe.
Find me a PSD2 bank bank that doesn't require a phone number
In this case, thanks to regulation, it seems GrapheneOS team is talking with European Commission about this problem with Play Integrity API https://fosstodon.org/@[email protected]/113623767380032309 and the only hope is a movement of the regulator against this policy of Google.
So the Play Integrity API is literally why I moved to iOS. My bank apps didn't work with Lineage and the stock OnePlus ROM just sucked ass after the ColorOS or whatever update. I figured I might as well go iOS if I can't have a custom ROM anyway, and so far it has indeed been a much nicer experience than stock Android. If you can't TRULY customize everything, might as well at least get stability and consistency out of it, right? Plus at the time, there wasn't a single Android OEM out there with truly long OS update support.
Anyway, if this succeeds and custom ROMs are considered to have sound integrity, I might just move back to Android. Graphene seems cool, I haven't tried it yet because I've never owned a Pixel.
How would iOS be better? There is no blob-free, secure version on their devices at all. Right?
It's not for privacy. But without access to custom ROMs, Android is shit.
Sure, but the ROMs is what makes Android a more secure platform
Sure, but my point was if you can't even use ROMs because then you lose access to your bank (and now McD apparently), there's much less reason to use Android - certainly was so 2.5 years ago when they were mostly all promising 2-3 years of support for flagship devices and Apple had a track record of 6-7 years.
Time to switch away from Auth I guess. Not even using GrapheneOS cause I have a Samsung phone, but this is not acceptable
Highly highly recommend Ente Auth!
Also featured on Privacy Guides
Aegis is also nice
I don't know if this is standard on all authenticator apps or not but I like the fact that Ageis makes you enter your password once in a while so you don't forget it.
Switched to Ente Auth when Authy stopped having a free desktop version. What if I lose my phone? I want both my devices to have access to my codes.
I wish aegis had a UI like that... I prefer it to Aegis "Normal" view. They're almost the same but ente is a little better
Authy is no good anyway. Keeps codes hostage with no way to back them up. So many great open source alternatives
Give Aegis a try, it is great.
same. i wish i could run graphene or something similar on my moto G stylus. I wish my Pixel 6, 7 and 6a didnt all have defects. the 7 was my favourite.
Not for Revolut. App only.
They do have a web app, it’s just very feature limited https://www.revolut.com/blog/post/introducing-the-revolut-web-app/
Like you can’t even pay people money kind of feature limited
But like, why?
Fuxk u
He makes a solid point
This surprises me because McDonald's app is hands down the worst app I've ever encountered in the history of all Android apps.
It's is sluggish, ignores touches/taps half the time, doesn't adhere to Android best practices for flow, crashes a lot, errors a lot, etc.
But OK McDonald's. Fuck off.
I can add that it requires location permission (even when you attempt to search manually with zip or city). What a shitty, dystopian timeline we are experiencing when we're mandated to run privacy invasive spyware, just to get a fucking discount on nugs.
It's almost as if a clown programmed it
Ronapp McDonapp?
OK McDonald's, I will not use your most cost effective ordering method. I guess I will just have to order my 10 individually custom cheeseburgers at the counter instead. I might have to have e the order read back, and change my mind about a few burgers.
As a former employee... That does nothing. Crazies that spend 15 min to order some fries were common.
If you go at rush hour it can be annoying to the employee and other customers, but at the end of the day nobody will remember and you would have spent 20 min and 10 dollars (which is 9 dollars material profit for MacDonald).
Just. Don't. Go. To. Macdonald's.
Best advice on the menu
Just stop eating at McDonald's.
This kills the american
Probably for the best.
Unthinkable. He lives and breathes McDonald's
Deny
They call it mackers in Australia
Maccas
They call a quarter pounder 'The Royal Cheese' in France
They don't call it a Quarter Pounder with Cheese?
Naw, man, they got the metric system there. They wouldn't know what the fuck a Quarter Pounder is.
How about the ~100 Grammer? Or even just "100 G" if you're trying to be "hip."
I don't know about other places but they haven't had a counter for years round here. They have big screens that you go up to to order and pay, then you get a number and pick it up when called. Even if you wanted to do this, no one is going to listen to you trying to order at the kitchen.
Entirely different country, but they still have a counter in addition to the screens; the counter is for when you want to pay cash
that's just screwing with the workers though, and the workers sure as hell is not going to get paid extra for your custom order
That worker doesn't want to be there, that's likely one of 3 jobs they need to barely scrape by.
You holding them up from doing other tasks they need to do to keep a job that barely feeds them is doing nothing but making their day a little harder. It affects the company 0%. The company is faceless and doesn't care how much you abuse the worker bees as long as they get your money.
I don't know what the answer is aside from not patronizing the company at all, but I know that's not it.
If the company is always too busy, they will need to hire more workers or the existing ones will leave.
I highly doubt it, if the store is too busy they'll likely either do nothing because why would they or if it's really bad add some robots who can handle the workload so they can get rid of those pesky employees.
In the past few years almost all of the fast food places in the closest plaza to me have been working on a skeleton crew. Lines wrapped around the building, 2 miserable employees, upset customers, but the money is still coming in.
Most people can't just leave their job, even a days wage can crush a lot of people.
Hey now, sometimes the company employs security that's extremely bored, incredibly racist, and looking for a low income punching bag to hassle.
Ahh how could I forget about the bored, racist, wannabe cops with nothing better to do. The perfect face to any modern company.
the cashier
Who is also the manager, making drinks, doing the fries because that bitch called in sick...
Calling someone who called out sick a bitch is a little bit insensitive, no?
depends on the situation. otherwise good employee who rarely if ever is sick and works hard calls in about being unable to work? absolutely fine
Person who i know knows exactly how many days a year over how many periods of absence it will take before HR get involved using it as a second pool of paid holiday days and leaving us high and dry to deal with the things she's paid to help the team with then yeah, bitch
her name was karen too...
This is a dick move if you don't tell your coworkers how to exploit the loophole too, and a heroic act if you do.
This is a dick move if you don't tell your coworkers how to exploit the loophole too, and a heroic act if you do.
Well i dont think it worked out for her.
a year or so after i left that company i heard she was sacked
Third time this week. Girl is lying.
I can't prove it, but I'm 99% sure Lyft did the same thing. Had a perfect rating (and was even a driver at one point), and they banned me without explanation right after I switched to GrapheneOS.
Emailed them a few times asking for the reason, and they refused to tell me.
_"Legally, we cannot release any additional information except that we found your account to be violating our Terms of Service.
We will be in touch if we are able to reopen your account in the future."_
There's absolutely nothing else that they could've misconstrued as "violating the Terms of Service."
If Uber's going down the same path, no more ride-sharing for me I guess. ¯_(ツ)_/¯
There's always traditional taxis I guess
Its machine learning fingerprinting. They lost the ability to fingerprint you, a flag was raised, and you're b&
When this happens to half your accounts, that's when you know you're winning at not being tracked
Uber still works under Lineage. Can't imagine what the heck they are trying to block
No idea. Gonna try to stick to the web app instead and hold off updating the native mobile app for as long as possible.
A valid excuse may be that they want to prevent GPS spoofing
Do the web apps not still work? I’ve booked Uber eats from a computer in the past, I’m imaging the phone browser version might still function. I don’t have lyft in my country to know tho.
I'll have to try next time and report back. Honestly don't use ride sharing too often. I prefer public transport.
There's no reason a company couldn't release the info legally unless it was under something like AML (anti money laundering) laws and you were flagged as a criminal. They legally can't disclose why in that case.
Using a different OS isn't reason enough, if they were telling the truth about the legal restrictions.
FYI, grapheneOS devs added a list of apps to their wiki:
https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos
Apparently, they don't need my business. Acceptable.
Is this not a sign of the true intentions on both sides of the dilemma here!?!?
Let us go to the end. We cannot afford to carry on in fear of these bans. Let the lines be neatly placed and the sides chosen wisely. If sustained profits are desired, the walled-gardens must come down.
Vote with your dollar and vote again with your data. Wary, but never afraid is the motto privacy comrades!
Agreed. Leave immediately to other services, and tell them why you're leaving. It might not make a dent, but you'll be doing the right thing at least.
Lol I spent a week going back and forth with Revolut support in august. I could sign into the app but it would always ask me for a "selfie" verification and every time support would say its a super dark selfie.
Eventually I decided to try a stock ROM and it just worked and I realised what was happening so I transferred all of my money out and deleted my account.
Most local banks here are terrible at making apps, some even require a separate device that looks like a calculator to use online banking, so hopefully they wont follow suit anytime soon
To be fair this actually provides a very high level of security? At least in my experience with AIB (in Ireland) you needed to enter the amount of the transactions and some other core details (maybe part of the recipient's account number? can't quite recall). Then you entered your PIN. This signed the transaction which provides very strong verification that you (via the PIN) authorize the specific transaction via a trusted device that is very unlikely to be compromised (unless you give someone physical access to it).
It is obviously quite inconvenient. But provides a huge level of security. Unlike this Safety Net crap which is currently quite easy to bypass.
Those little boxes are just a bit of hardware to let the smartchip on the smartcard do what's called challenge-response authentication (in simple terms: get big long number, encode it with the key inside the smartchip, send encoded number out).
(Note that there are variants of the process were things like the amount of a transfer is added by the user to the input "big long number").
That mechanism is the safest authentication method of all because the authentication key inside the smartchip in the bank card never leaves it and even the user PIN never gets provided to anything but that smartchip.
That means it can't be eavesdropped over the network, nor can it be captured in the user's PC (for example by a keylogger), so even people who execute files received on their e-mails or install any random software from the Internet on their PCs are safe from having their bank account authentication data captured by an attacker.
The far more common
two-way-authenticationedit: two-channel-authentication, aka two-factor-autentication (log in with a password, then get a number via SMS and enter it on the website to finalize authentication), whilst more secure that just username+password isn't anywhere as safe as the method described above since GSM has security weaknesses and there are ways to redirected SMS messages to other devices.(Source: amongst other things I worked in Smart Card Issuance software some years ago).
It's funny that the original poster of this thread actually refuses to work with some banks because of them having the best and most secure bank access authentication in the industry, as it's slightly inconvenient. Just another example of how, as it's said in that domain, "users are the weakest link in IT Security".
You had me until banks are secure. Most banks use 2FA over SMS. All banks in the EU require a phone number for PSD2 requirements.
With GPG and TOTP support, its been easier to secure s Facebook or google account better than 99% of bank accounts
I literally said 2FA over SMS is not secure because of weaknesses in the GSM protocol.
It's still more secure than username + password alone, but that's it.
Sure, but afaik all EU banks require a phone number so they can send OTPs using your phone for transaction auth. This is a mandate of PSD2.
My disagreement is with your last paragraph. Because of this regulation, banks are horrendously insecure. If I refuse to enter a phone number when signing up for a bank account, I literally cannot get a bank account in Europe. That's insecure despite the user, not because of the user.
It think you're confusing security (in terms of how easy it is to impersonate you to access your bank account) with privacy and the level of requirements on the user that go with it - the impact on banking security of the bank having your phone number is basically zero since generally lots individuals and companies who are far less security conscious than banks have that number.
That said, I think you make a good point (people shouldn't need a mobile phone to be able to use online banking and even if they do have one, they shouldn't need to provide it to the bank) and I agree with that point, though it's parallel to the point I'm making rather than going against it.
I certainly don't see how that collides with the last paragraph of my original post which is about how the original thread poster has problems working with banks which "require a separate device that looks like a calculator to use online banking" which is an element of the most secure method of all (which I described in my original post) and is not at all 2FA but something altogether different and hence does not require providing a person's phone to the bank. I mean, some banks might put 2FA on top of that challenge-response card authentication methods, but they're not required to do so in Europe (I know, because one of the banks in Europe with which I have an account uses that method and has no 2FA, whilst a different one has 2FA instead of that method) - as far as I know (not sure, though) banks in Europe are only forced to use 2FA if all they had before that for "security" was something even worse such as username + password authentication, because without those regulations plenty of banks would still be using said even worse method (certainly that was the case with my second bank, who back in the late 2010s still used ridiculously insecure online authentication and only started using 2FA because they were forced to)
Transmitting an OTP to the user is a security risk.
Banks in the EU are, in fact, forced to implement 2FA using phone numbers as part of "dynamic linking" requirement of PSD2, which makes more secure methods of 2FA (like TOTP) not allowed
In Germany they're called TAN generators if you want to learn more
Crazy how the response is to completely gaslight you about what the real issue is
That's pretty typical when its a low level machine learning algorithm that flagged the account. Usually the support rep legitimately doesn't know, and you'll get stuck in an infinite loop
I don't think it's a coincidence that the shittiest companies are those, who enforce Google's broken and monopolistic "Play Integrity" API. Revolut has connections to Russia, McDonalds supports the Israeli genocide in Palestine and Authy has always just been a massive piece of shit, not even allowing users to export their TOTP seeds. These are three companies I would NEVER even consider using anyway.
And "Play Integrity" API actually does NOTHING, absolutely NOTHING for your security as an end user.
You use an outdated, unpatched Android version with multiple severe, publicly known exploits on an insecure device?
Google doesn't give a single fuck.
You use the newest version of Android with all the patches applied on Google's own hardware, with a locked boot loader and a hardened operating system?
That's not allowed by the "Play Integrity" API.
It's only purpose is to serve Google's monopolistic business interests.
Why would anyone load an app from McDonalds? You want to give them elevated access to your most personal data for a few dollars of coupons?
What are they taking from you that's worth more than the discounts they are giving you? Because they are definitely making a profit, or they wouldn't be doing it.
We are definitely in the era where people think discounts before user privacy. I bet most of people downloading the Mcdonald app do it exactly because of cheeper prices and easy of access.
just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.
just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.
How did you manage to post the same comment 4 times? 🙃
i use my very own #snac instance which is sometimes slow. i pressed the post button 4 times.
just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.
just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.
just had medium fries and coke. many people i know, including myself, use the mcd app because of the discounts it offers when ordering through the app. however, i am under the impression that since i use an ios device and have the option to decline being tracked by the app—which i very eagerly press "no" to—i am on the safe side. am i?
No, Apple isn't your guardian angel with the press of a button.
Apple does extensive audit of mobile apps, including limitations of tracking. So the app cannot spy on something you are not letting it to know. But you are giving it a bunch of info voluntarily.
I'd say using that app on iOS is similar to making a food delivery order using a loyalty member ID. Basically, you are letting the company (McDonald's) know who you are, what is your phone number, where do you live, and what do you like to eat. And if they wish to, they could use all that to purchase your profile from a data brocker. Or they can sell that info for a few cents to make up on that discount.
I used to work hosting Focus Groups, we would pay cash, and top dollar for even small chunks of specific data sets on demographics that would age very quickly. Since people's habits change, different trends, feedback, etc. Hence the need of constant campaigns. Today, people give a lot of this data away, for free, in a constant data stream, for months if not years on end for cents or even a couple of bucks a month. Via constant tracking and profiling. It's crazy how privacy illiterate people are.
No it won't. Or at least they said on BlueSky that if there had been a work around for this they would have solved it already.
What aboit downloading thw app feom Aurora Store? I think that would solve most of the problems
How would that change anything?
I mean remote attestation is cryptographically secure (unless there's some temp implementation vulnerability).
man, and i was gonna switch to graphene this christmas. if every app can just ban my OS, i might have to rethink this. i would use the website but they restrict so many things to apps now…
Well, switching to GrapheneOS shows that you don't care what those companies do, and that you're willing to fight. It means those companies lose one more customer. The more people that use GrapheneOS, the more companies will be forced to support it.
Honestly i didn’t even think of that. i’ll still switch then!
Nice choice. You not switching is exactly what these companies wanted.
I was about to switch bank because for a few days my current one (inadvertently) blocked it on grapheneOS. We sent them a few emails and they fixed in less than a week.
I use a small local credit union that doesn't appear on their supported list. It's literally the only thing holding me back, I'm tempted to say fuck it anyway. But I wonder if it might work anyway...
If nothing else can you use the browser?
I've used Hermit for years to present websites like an app, and am using Native Alpha on my new phone.
Yeah you're probably right. I've gotta get a new phone before I can really attempt it, but I'll at least try!
What's the app name? I could install it and see what happens
TBF, this is the first time I've encountered an app not working - and it was before this. It's just because of Google push towards monopoly via their Play Integrity API that's ruining this.
play "integrity" should be considered malware, any program that deliberately does something the user doesn't want it to should.
Use a browser like Native Alpha or Hermit, which present a website like an app.
And if you use Bitwarden/Vaultwarden for your passwords, it can be pretty seamless.
NativeAlpha
Hermit
Can Graphene add a feature to run in emulation mode to allow apps to believe it's on an unrestricted OS?
Unfortunately, this is probably because of the apps started using the Play Integrity API, which is a hardware-based attestation and can only be faked in two ways that GrapheneOS isn't interested in:
Banks seem to be hit or miss, happy that mine works. Would rather switch Banks than use a stock Rom, though.
All the Uber stuff works in Browser, both eats and their fake taxi stuff.
Not having a subtle reminder to eat at McDonald's is probably better for you.
Honestly, if your app could be a website, and includes services not on your website, fuck you, I'm gonna go to the competition.
Use the websites whenever you can. That's what I do at least. Although I had to stop using Lyft entirely, because they stopped supporting rides from their website apparently. And that leaves just Uber. I actually left my bank for a similar reason. It supported my phone just fine, and it worked without Google Play Services, but the website wouldn't let me do everything that the app would, and the app required that I have Aurora Store to download their banking app from the Google Play Store, and I wanted to get away from that, so I switched banks so that I could use the bank website instead. From what I can tell, you run into this kind of stuff a lot with FinTech apps. But if you use older banks, like Discover or Wells Fargo or things like that, they tend to work better. Maybe because they're not up with the newest technology, LOL.
Yeah Revolut is also the kinda app that is almost only a mobile app, not much you can do with their website, last i checked.
Correct. This is the reason not to use Revolut.
Choose Wise instead.
Revolut was the one I was looking at if I'd switch to Graphene.
lol, I've observed the same.
Fancy "Digital Wallet" thingy is absolutely decked out in Root detection, meanwhile my older, physical bank's app doesn't give a fuck.
I've never been too fond on the idea of a 100% digital bank so no loss for me!
This sounds like an antitrust legal problem...
The GrapheneOS team is already talking to regulators: https://grapheneos.social/@GrapheneOS/112539378681400395
Authy has been utter garbage for a long time and if you ever needed a reason to migrate away then now is as good as ever.
Do you have a replacement you would recommend?
If you only use Android, go with Aegis. For a end-to-end encrypted, cloud-synced (also self-hostable) solution, check out Ente Auth. It also works on desktop.
Aegis? https://f-droid.org/packages/com.beemdevelopment.aegis/
Well pick anyone listed in this AlternativeTo list but I recommend Aegis
https://www.w3.org/QA/Tips/noClickHere
Oh, I was using Keepass2Android as a password vault, but was a little frustrated with it because occasionally it'll forget to synchronize with the file before adding an entry and leave a "conflicted copy" I have to deal with manually. If KeepassDX will also do TOTPs that sounds perfect.
Well that's bad. I've been using revolut for years now.
Does anyone have a suggestion for a new bank that's operating under european law?
Perhaps WISE? You can use the web page unlike Revolut.
Wise isn't a bank, but it does appear to be the best option in EUR
Wise has a banking license in Belgium much like Revolut has one in Lithuania.
Wise is missing some cool things Revolut has like metal cards that require you to use an expensive plan, or the ability to buy stocks and crypto.
What Wise has instead, is the ability to have both a REAL American AND European bank account in the same app, which you can instantly transfer money between. Revolut doesn't give you an American bank account if you're in Europe, idk if they give you an European bank account if you're in the US. But Wise has both.
Why is this so important? Well let's say you're in Europe, you land a side gig doing a bit of work for a big US corporation you're connected to through your old job. You've got your rate negotiated, everything's sweet. And then they hit you with the question: "Are you able to take ACH payments?"
Now you have to google what an ACH payment is. Then you have to find out how to be able to receive them. Turns out these are internal to the US. Banks outside of the US just don't accept them, because they're not part of the system. But wait! Wise actually gives you an actual US bank account complete with routing numbers and everything. In your name, not in some proxy's name either.
Here's a list of currencies/banking systems you can get local payments in, without going international
Yes I sound like an advertisement at this point, but it's ridiculous how useful this gets if you need to move money internationally. I didn't get all the hype before I needed it, but when I did, it fit my use case like a glove.
I have wise accounts both as a US entity and a EU entity. They give you EU IBAN and US ACH accounts no matter which side of the Atlantic you're registering from.
They're the best bank ive found in the EU too, but I didn't think they were a bank. Its important because a US not-a-bank just collapsed and a lot of people lost their life savings. The not-a-bank assured customers that their money was safe because it was being stored in actual bank's bank accounts. This would have been true, but the not-a-bank misplaced almost all their funds and, turns out, they weren't in their partners' bank accounts. Whoops.
Turns out it's not an actual bank in the EU either, they just give you an IBAN number and everything.
However, funds in EU are still insured at 20k per account and since they're not a bank, they can't be giving out subprime mortgages using your money like banks do, they have to keep it as safe as possible.
Yeah but if they're not regulated like s bank then they could do the same thing and "misplace" funds so they're not stored in their partners banks, and you then have 0 insurance, right?
N26 maybe?
Most banks restrict custom ROM and root access devices for security purposes. Same with MFA apps. I get it. From an IT security perspective, restrictions on software compatibility limit the number of failure points. Even if you find a custom OS that is more secure as an OS, it is installed through opening up your device to security risk and there is no real requirement for you to close up that security risk afterward. My company has made the same choice to restrict supported platforms for our services.
McDonald's app restricting the OS is probably some security decision they made because it's more secure even when they probably don't need it though.
It's not your job to secure my device. It's your job to provide the service I'm paying you for.
I never said it was. It's also not the developers job to provide you the service on the platform of your choice. It's the developers job to protect the companies servers and data. It's the company's job to provide you the service and it's your job to decide to use it or not. And it sounds like you don't like the means of service provision. So don't use it. Easy enough.
fuk em keep using it
If you log out of your account it's said you can't log back in.
take your money over to their competitors
If a business makes it too difficult to use them I just use someone else. I'm sure they understand that but are making a killing at the expense of other people.
There will come a day when there are no alternatives. Ive hit this in many places (EU banks, dating sites, etc)
Their loss.
Well, Google is known for destroying its opposition.
This has very little to do with Google. Custom OS's in general are being restricted by these apps, not Graphene in particular. All custom OS's and root access devices are inherently less secure, even if they are privacy focused OS's.
In IT this is called a zero trust. You don't trust anything you cannot verify yourself. And a user installed OS is not something anyone can verify other than the installing user. Obviously for your own security you have your own zero trust policy if you are using something like Graphene, but these companies aren't making it more secure for you as a user, they're covering their asses in case there are holes in security they cannot account for.
I had Custom OSs installed before. My bank works fine, but there are apps that require Google Apps. I'd say that's got pretty much to do with Google.
You're implying that Google is causing these apps to not support custom OSs. But it's literally not true. These apps are just not supporting custom OSs because their businesses don't want to support non-standard platforms for security purposes. Tons of banks do not support custom OSs. It has nothing to do with Google and everything to do with not trusting the user which is 100% the correct approach for cyber security.
Got it. So it's something similar to latest security proposals like not letting me download files on Windows because they are not normally downloaded. Or visiting a website with self signed certificates. So it's more secure.
The apps complain: "You need Google Play services to use this app".
So it's about security. Right. What kind of security does McDonaldss need? Does it need security for their coupons?
Besides that, I thought payment gateway provided very good security by themselves.
But let's steer from what happens on mainstream apps a little.
Isn't Google Wallet or Online payments insecure too? Don't they have tons security failures also? Human security failures, like if someone robs my phone and my info they would have access to my money?
Google and the smartphone industry employ accelerometers and other methods to make sure robbers can't get to the system. They admit themselves that the systems aren't safe and they're working on AI and electronic methods to avoid access to sensitive information.
Is this the security you're talking about? Maybe we should just steer the industry another way, like those Custom OSs do. Alternatives aren't security potential threats. They're the solution for the problem.
Making a monopoly based on making it "safe" isn't secure at all.
It's not for your security. It's for the company's security. You're really dense you know that. This is not about you and it's not about Google. What I'm saying is, people suck ass. So to protect themselves from people sucking ass, they restrict access to their system to their terms. Completely fair if you ask me.
You can go cry Google bad all you want. I might even agree Google is bad. But this is not a Google thing. It's an IT security thing. The banks and MFA providers are security first businesses. They will make the decision that protect them first and it makes sense for them to do so. If you owned a bank, there is a high likelihood you would make similar decisions that end users don't quite understand.
As far as McDonald's is concerned, who the fuck knows what their developers are doing. That app is trash anyways.
perhaps dial back the attitude a bit there? if you think you know better than someone (even if you're wrong), then you should have no trouble kindly educating instead of insulting them.
you may also wish to revisit your highly questionable claim that graphene properly configured on pixel is less secure than stock rom on some random android device.
It's not questionable at all to assume that a user rooting and installing their own OS is a security risk. That's the entire premise of zero trust. I'm sure Graphene OS is secure and better for user privacy when configured properly. But you can't trust that an end user will configure it properly. That's what I am saying and have been saying since the first message. You can't trust the user to be security minded. Ultimately, the best thing you can do as a developer or a business is support a known quantity of software and hardware configurations and that likely means only supporting OEM installed ROMs.
Would not updating Revolut keep the app compatible as long as you don't sign out?
If so, don't update the app and write down the build number of the last app version which worked on GrapheneOS. That way you would have a bit more time to sort things out.
They constantly force you to update or the app won't work. I was already having issues with Revolut on GrapheneOS so I just closed my account and switched to Wise. The Revolut app was a bloated mess anyway.
Yupp thinking about doing the same, but want to wait a little to see if wise decides to do the same..
Guess I'll have to follow suit, because I'd love to switch to graphene OS
Google has ruined Android by closing it up.
EU needs to step in and force Google to open it up.
While at it, go for Apple's monopoly as well.
I haven't switched my phone yet, but will do so soon. Does anyone have experience with compatibility layers on phone, akin to wine? I unfortunately cannot go without my public transport apps, and they're android or IOS only. I've looking into postmarket OS, but open for suggestions.
GrapheneOS is Android.
Huh TIL, thanks! So would apps usually work, just like on regular android? Except the aforementioned, of course.
Most EVERYTHING works unless your app dev is PoS like these guys.
Another alternative is MicroG which might work better in light of recent development.
How zealous are you on dumping google?
Well yes and no. The point is to stop using Google. And that entails quite a few things you might expect a phone to do
You can take a look at calyxOS, it's what I use. Android but with all Google telemetry ripped out. It's not as resistant as graphene against a govt adversary, but for privacy, better battery (bc google stuff isn't constantly running) and still being able to use everything, it works great.
You can use Waydroid on PostmarketOS to install Android apps. It basically runs a full VM for you.
What public transport apps if I may ask? Most of Western Europe and especially Germany present no issues and even have OSS options, same with Finland.
Thanks for the input, i realise it's been a while since I checked this! ÖBB Scotty, ÖBB Tickets (could forgo this one) and SBB mobile. I also need Digitales Amt (official government app for things like signing contracts without printing them, ordering your election materials to a different address than usual, checking your medical info etc). Do you happen to know whether that would work?
Don't know and sadly my Pixel got stolen recently, but you can see if Offi or Transportr meet your needs, they're available on fdroid.
I guess I have bad news for you regarding the government app: https://discuss.grapheneos.org/d/253-compatibility-for-austria-e-government-app
Anyway depending on your threat model keeping a normiephone as a decoy and mainlining something like graphene os can be a good opsec decision.
Nice, thanks for the tip! Also thanks for going through the trouble of finding out for me, I appreciate it! I'm unfortunately in one of the regions where it's specifically not available. But the second phone thing might be an option. That, or just a compatibility layer with regular old android after all.
Well you can use Calyx instead, which supports microG instead of Graphene, at the expense of somewhat lower security level. Or wait until sandboxes google services gets patched accordingly.
Can I simulate another OS environment for these kind of apps?
Stops working if you log in and out of your account. At least this is what GrapheneOS folks stated on BlueSky.
Next update
Wait until the next update.
I think we gonna start learning who actually can't handle not getting your data finally.
Also microg v sanboxed gps debate might get resolved
I'm a microG guy, so I use Calyx. I wish graphene supported microG.
also as a former driver I just want to say DOWN WITH THEIR ECONOMIC TERRORISM!
Uber driver
It stopped working in April or May I think so that's interesting
Small OT: In the article it's mentioned also the app "IO" (italian for the english word "I"). There are also other important italian apps not working without play services. The serious thing is that that apps are almost mandatory to do the ordinary public administration bureaucracy. We can say that the italian state forces its citizens to use a smartphone with Google Play Services installed. This is no sense.
womp womp.
Oh great, I guess I'll have to change my payment info for everything now. Fantastic.
Anyone tried waydroid or android in an emulator for these type of apps ?
Oh yeah that's an insta-ban. And even the waydroid app devs say their security is atrocious and you shouldn't use it for banking.
The list of apps that want to invade your privacy populates itself?
Are there any checker apps to see which of user's installed apps have this? Looking up "Play Integrity API" only finds the checkers for the phone itself...
@Sunny
Gatekeeprs of wealth sticking together against the ambition for freedom of poorer people?
Oh, color me surprised. 🙄
(I want to de-Google step by step, thanks for the heads up).
I use Authy under a separate work profile on graphene with no issues 🤔
I use Aegis.
But when did you set Authy up? I don't recall when Authy made the change, but it wouldn't kick you out. It would, however, prevent you from signing in a new device. So if you lose your phone, you might lose access to those tokens...
Oh ok. Yeah it was a while ago. Will have to switch to something else soon then.
Guess you won't be for much longer 🤷 I'd bare careful with logging out.
Seems like my time to move away from Authy. Any drop in alternative for iOS? Ideally I could export services and load them back, not manually adding/removing 1 by 1. Even if I can't though, suggestion still welcomed.
Just run PWA instead no?
For Revolut? Unlikely, their website forces you into using the app.
The others sure, i guess, but i don't see the user overlap.
It's a mobile app only. The web interface is strictly for managing your account, last I checked.
I swear I am so close to jumping into the void of mainline linux on phones.
The only main issue is device drivers, but I would be fine happily extracting them from android or making new ones. Modern Android is a complete full stack POS.
Maybe it's worth keeping a budget mobile phone at home with Rustdesk host running on it? When you have a need for an app that must run on a genuine Android, you just remote into that phone. Since the phone never leaves home, there's less to track.
This is actually good, see it as an enrichment of your life. The only sad thing is Revolut though.
As an alternative to Authy I recommend Stratum (previously known as Authenticator Pro) https://apt.izzysoft.de/fdroid/index/apk/com.stratumauth.app
This due to its compatibility with Android wear (companion)
Revolut works fine for me still on Graphene?
I use McDonalds App all the time on GOS this only affect you if you use Google Pay when checking out to my knowledge.
3 shites dropped.
It always seems that with finance we take 2 steps forward and 1 step back. That's why Bitcoin will never stop existing.