[jojobas]

While this is awesome, I'm kinda skeptical on the premise on two points.

Almost nobody cares about privacy, and this is going to be super expensive. I might be fine with paying extra, but the economy might not work out, like it didn't for Blackphone. Fairphone is barely alive as well. Seeing as phones are just source of ad money Google can drop the prices on their phones as well.

Some European countries and banks already require crap like Play Integrity for essential apps. So far it's possible to hold out, but for how much longer?

[zerof1l]

GrapheneOS user here. Every single banking and financial app I use works. Both European ones and non-European. Some require changing per-app settings, but nothing crazy. There's a good chance that your banking app will work.

https://github.com/PrivSec-dev/banking-apps-compat-report

https://privsec.dev/posts/android/banking-applications-compa...

[strcat]

We're working with a major Android OEM on the future generations of their existing devices meeting the official GrapheneOS requirements so we can officially support their devices. People will be able to buy the regular devices and install GrapheneOS at no extra cost. We're talking about selling devices with GrapheneOS preinstalled but that's not a requirement for the partnership to be a success and other companies could still do it as they do now with Pixels.

Play Integrity API doesn't impact GrapheneOS as much as other alternatives not focused on privacy and security in a similar way. A subset of the apps using the Play Integrity API are explicitly permitting GrapheneOS via hardware attestation including multiple banks like Swissquote. We're working on convincing more banks to permit it. Our hope is for regulators to invalidate the current approach and require defining clear security standards which need to be fairly enforced. The status quo of some banks banning using a much more secure OS that's even much more heavily using hardware-based security features while permitting a Google Mobile Services OS with no patches for 6 years is a massive antitrust issue. It impacts every alternative hardware platform and OS since Android app compatibility is important for competing. The obstacles to getting approved should also not be unreasonably high. It's better if apps don't do this but we can accept they are going to do it if it's a fair system permitting competition, unlike the Play Integrity API.

[XorNot]

This is the real problem: I need my phone to work with my bank. So whatever we're doing, that's the bar to clear.

[nebula8804]

Buy the cheapest updatable phone that will work for your bank(probably a used iPhone) and use a free OS for everything else.

[dns_snek]

No, I don't want to buy, take care of, and carry around 2 devices at all times. I'm not a drug dealer.

[drnick1]

You don't have to carry two phones. The idea is that the second phone stays home powered off and is used as an access token for the bank's website. There is no reason to carry it around. Pay cash in stores or use a credit card when cash is inconvenient.

[dns_snek]

I think this is a pretty outdated view of banking. I open a banking app at least a few times a day. In the EU just about every online transaction has to be approved in the app, we also use various payment apps for quick person to person transfers, use the app to generate disposable virtual cards for online purchases, etc.

I could cut myself off from the modern financial world and just use online banking like it's 2010 but that's a pretty big ask.

[structural]

Is this a EU-specific thing? In North America I've never installed a banking app, don't even know if my institution even has one.

[sharts]

Not a drug dealer but perhaps a bank dealer

[mfru]

so only drug dealers use two phones?

[dns_snek]

Pretty much, yes. Drug dealers and people who are getting paid to carry a second device for work by their employer. I am neither.

[mfru]

I'm sure you have evidence for this, I am certainly not fitting into your frame.

[Kudos]

I use 4 different banks, they all work with GrapheneOS.

[kytazo]

I use 3 banks, they all work as well. Plus they're all on a separate user profile, which makes it even more secure.

[foresto]

Is there something important in banking apps that cannot be done with a web browser?

[Gee101]

My bank uses the banking app for auth if I try and login via a browser.

[HPsquared]

Barclays in the UK offer (or used to) a hardware device with a keypad allowing the user to do a challenge-response using the bank card's chip and PIN. Not sure if they still do, though.

Edit: https://en.wikipedia.org/wiki/Chip_Authentication_Program

[potamic]

What if one doesn't own an android/iphone device? Banking is a fundamental need, so most countries regulate them to cater to a wide range of users. In this case it's possible that the bank could be compelled to provide you a 2FA device if you don't have one.

[distances]

I don't think there is such regulation. Many banks simply do not have any other means of authentication any more. They can't give out 2FA devices because their systems just don't support them.

[pjmlp]

Good luck with that, in Germany many public transport operators are moving into app based tickets for the monthly/yearly subscriptions.

You can still get a plastic card, however it requires paying extra and some additional forms, the reasoning being it is not environment friendly.

[majirdulb]

Do they offer a physical 2FA device? Mine does and it's really useful

[array_key_first]

That's because they're stupid or doing something suspicious, probably both.

There's legitimately zero reason to allow 2FA only on your own propreitary app. You can't even make a financial argument - allowing other TOTP methods is cheaper because now you don't need an app!

[buzer]

Unfortunately the EU regulation makes the truly user controlled 2FA methods essentially non-compliant.

https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

> Article 7 Requirements of the elements categorised as possession

> 1. Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as possession are used by unauthorised parties.

> 2. The use by the payer of those elements shall be subject to measures designed to prevent replication of the elements.

[jojobas]

This says something along the lines of "it should be hard to extract the TOTP secret".

However if you can get so far as to get the secret from the TOTP app, you can as well back up the entire phone and restore elsewhere, can't you?

[weikju]

> That's because they're stupid or doing something suspicious, probably both

Small comfort for whoever needs to use that bank. This is the disconnect geeks and Free Software needs to bridge to make any headway.

[array_key_first]

I mean, I concur, but ultimately I can't fix shitty banks being shitty. No geeks can. Banks have been shitty for a long, long time.

Do you know how we usually stop them from being shitty? Forcefully, with legislation.

[exe34]

it costs basically nothing to change banks. you sign up to a new one and they transfer your account and direct debits. you just tell your employer where to send your next salary payment.

[cookiengineer]

Maybe the real focus should be treating Android as a single purpose environment rather than your real/life depending one.

Maybe the better approach would be focusing on getting postmarketOS to work, and use an emulation or recompilation layer that is running Android in a box (pun intended). Anbox and others were still too painful to use for daily usage, but maybe you can get rid of everything except the things that Play Integrity checks against? Maybe we can make waydroid work?

[1] https://waydro.id/

[strcat]

Waydroid is not a private or secure way to run Android apps. It uses an old fork of LineageOS and throws away most of the privacy and security model with how it's implemented. It does that to run Android apps on top of a much less private and secure base OS. Compatibility is far worse and it in no way avoids the Play Integrity API checks. Most banking apps do permit GrapheneOS and some of the apps banning using a non-stock OS or non-GMS devices with the Play Integrity API have explicitly permitted GrapheneOS via hardware attestation including Swissquote. Banks have no reason to ban GrapheneOS since it has all of the standard privacy and security model combined with major privacy and security improvements. They're often willing to permit it once they understand what it is and how they can verify it with a standard Android API. Convincing every app using Play Integrity to do this case-by-case is painful and unrealistic, but regulation can require permitting secure alternatives meeting defined security requirements.

[throawayonthe]

why not the other way around? aosp already has a much better security posture, already runs almost everything virtualised, and will soon run 'desktop linux' apps in a vm

in fact statements from graphene suggest they hope to eventually move away from linux on the host

[jojobas]

Doesn't play integrity verify the hardware among other things?

[throawayonthe]

it won't be a special graphene phone, they are working with the OEM to make their next flagship meet graphene's security requirements; it'll just be another phone they support that isn't a pixel