[TSUTiger]

Off twitter/x you miss the tweet quoted reply[1]:

The article unfortunately leaves out most of the points we made in the thread.

GrapheneOS supports hardware-based attestation and it's entirely possible for Google to allow it as part of the Play Integrity API. They choose to ban using GrapheneOS.

[1]: https://nitter.privacydev.net/GrapheneOS/status/181841539179...

[thrtythreeforty]

As a baseline for discussion, I agree that GrapheneOS is far more secure than stock Android (fantastic Cellebrite citation, by the way). I'm not attacking your assertion that Google is misusing Play Integrity anticompetitively, which you make a plausible case for.

But hardware-based attestation is fundamentally based on a whitelist of OS images. With AVB, the only job of hardware is to validate that the chain of trust starts with the certificate the user provides (or the factory default). That certificate, if controlled by a trusted party, attests that the resulting chain of trust implements the Android security model correctly. But all the Android API does is provide a verifiable attestation of what is running; it can't attest that Android hasn't been e.g. Magisk'd and then re-signed. (Please correct me if I'm wrong here!)

Google trusts themselves, of course, perhaps too much. But, they're unwilling to add others to the whitelist of things they trust. I think what you're asking for, is actually for the Play Integrity code to have some mechanism to become trusted/whitelisted (this would prevent other app devs from having to play whack-a-mole to allow other secure images). Phrasing it that way might be a good clarification.

[TheCoelacanth]

They don't seem to have an issue with trusting other phone manufacturers, many of whom have a very half-assed attitude towards security.

Why would they have an issue with trusting the single most security-conscious Android OS producer other than preventing competition?

[olliej]

I don’t use twitter, so I - and anyone else who does not use twitter - only see a link to ars. It’s literally just a link to a link.

If there’s more information, that information should be on a public site (maybe the grapheneos website?)