Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS – Break Free from Google and Apple

blog.tomaszdunia.pl

Post reply on HN
Print view View original

161–170 of 967 posts

Re: GrapheneOS – Break Free from Google and Apple

#161

Post by omgmajk »

birdsongs wrote: post #129
bergheim wrote: post #105

Been using this for about a year on a p9 pro. It works very well. I hear the google tap to pay does not work, but I've never tried it. However Vipps with their tap to pay works fine. BankID works but not with biometric login, which some things require IIRC. And for some reason DnB private works fine, but you are not allowed in on the corp app. It's mind boggingly stupid that they lock down apps like this, when you ca…

I was the one that submitted the DNB Bedrift app report to the sec dev repo! I contacted DNB but they never responded to my email. I wonder if we can find a dev? I believe that's how the private app got fixed. Want to use Vipps tæpp so much but I have Nordea for private and they don't allow it on their cards, for whatever godforsaken reason.

Does the Nordea app work on Graphene? I am curious because I have been itching to switch my main phone to an alternate OS.

Re: GrapheneOS – Break Free from Google and Apple

#162

Post by hengistbury »

palata wrote: post #112
haunter wrote: post #29

Break free from Android... by installing Android? I'm not sure it's really breaking free when the first task to do is intall Google Play Services so your banking app works. Sounds like we can't actually breaking free from Android and iOS. Maybe with Linux like the Fedora Atomic for mobile devices? https://github.com/pocketblue/pocketblue Or PostmarketOS? https://postmarketos.org/ Even then banking would probably only…

You're confused. GrapheneOS is not Android, it's an AOSP-based OS. > I'm not sure it's really breaking free when the first task to do is intall Google Play Services so your banking app works. sandboxed Google Play Services. It's an important difference.

What is the difference here between "Android" and "AOSP" (Android Open Source Project)?

Re: GrapheneOS – Break Free from Google and Apple

#163

Post by b112 »

fodmap wrote: post #142
bergheim wrote: post #105

Been using this for about a year on a p9 pro. It works very well. I hear the google tap to pay does not work, but I've never tried it. However Vipps with their tap to pay works fine. BankID works but not with biometric login, which some things require IIRC. And for some reason DnB private works fine, but you are not allowed in on the corp app. It's mind boggingly stupid that they lock down apps like this, when you ca…

> It's mind boggingly stupid that they lock down apps like this, when you can just open the thing in a website anyway. I can use my bank on some linux distro... Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I have several linux phones but I can only do banking with their…

Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website.

I've seen this elsewhere, and it's absolutely ridiculous.

Why?

Because in almost all cases, the apps may only be installed with Google Play, and require the framework to work correctly. And that means?

If you are not in good standing with Google, you cannot bank!!

I cannot stress how inane it is, to have Google or Apple as the gatekeeping to identify verification. How not having an active, in good standing account with one of these two, means you cannot bank.

And it's happening more and more.

Meanwhile, banks -- which tend to make billions in profits quarterly, do this to save on infrastructure costs. They do it so they don't have to stand up their own push servers, or have an app which doesn't require firebase.

Well cry me a river, boo-hoo Mr Banker, I'm not even remotely interested in you saving on infra-structure costs at the loss of autonomy. And on top of this, many banks are reducing hours, closing branches, claiming that they don't need them.

Leaving absolutely no other choice.

This sort of thing should be illegal. Being in Spain, but requiring a US megacorp to tell your own bank, that you're you.

Re: GrapheneOS – Break Free from Google and Apple

#164

Post by wishfish »

6jQhWNYh wrote: post #22

It's a shame only Pixel phones are supported. I have PWM sensitivity and Pixel phones are notoriously bad for this, my eyes hurt when I look at one for more than 30mn. Due to the lack of good, secure alternative, I have had to give up on privacy in exchange for manufacturer updates.

I'm in the same boat. Bought a 9 Pro XL and had to return it. Hope their OEM will use DC dimming for the screens or have an IPS option.

In the meantime, I use a Motorola G Power 2024 which has IPS. I'm very much a non-expert but made a minor hobby out of trying to de-google it as much as possible.

Never signed into Google with it. Using NetGuard with a whitelist to prevent most of the phoning home. Uninstalled or disabled most built-in apps. The apps I use are installed via either Obtanium or Fdroid. Have Dropbox from Aurora. Use Motorola's private space for keeping some data and apps in a separate, supposedly secure locker.

I'm sure this doesn't come close to GrapheneOS's security level but it's the best I can do within the limitations of this device. It was a fun mini-project. NetGuard is invaluable for this purpose. Almost feels like the phone is truly mine.

Re: GrapheneOS – Break Free from Google and Apple

#165

Post by darkwater »

Tharre wrote: post #146
darkwater wrote: post #74

Earlier quoted context omitted.

Unless the next best thing makes you think you are already achieving the "perfect solution" for what you think you care about, but in truth does not. I'm not a mobile phone security expert but my feeling is that in the case of GrapheneOS - which target is probably high-profile people at risk of state actors et similia attacks - a zero-day in the closed source firmware from Qualcomm will probably screw you anyway. I u…

> a zero-day in the closed source firmware from Qualcomm will probably screw you anyway. All the devices that GrapheneOS supports implement a clear separation of the baseband and the CPU in the form of SMMU, ARMs version of IOMMU. So a zero-day in the baseband does not immediately screw you - unless the code on the CPU side also contains vulnerabilities or there is a major flaw in the SMMU implementation that somehow…

Thanks for the clarification (and to the others that answered as well).

I probably explained myself in a shitty manner, I didn't try to downplay GrapheneOS efforts, and I should have kept my initial statement about "next best thing can create a false sense of completeness" as a generic remark and not specific to GrapheneOS, for which I don't have enough knowledge to know if it applies or not.

Re: GrapheneOS – Break Free from Google and Apple

#166

Post by domh »

choeger wrote: post #28

What about device attestation? Will you be able to run banking apps and Netflix et. al.? For me the biggest concern is that while you may be able to use and run your own device, you will be locked out of most propietary services. Much like how more and more websites simply don't work with Firefox anymore.

Here's a community maintained list of apps and whether or not they work:

https://privsec.dev/posts/android/banking-applications-compa...

This is linked to from the Banking Apps section on GrapheneOS docs: https://grapheneos.org/usage#banking-apps

Sample size of 1: my UK banking apps all work fine.

Re: GrapheneOS – Break Free from Google and Apple

#167

Post by bergheim »

birdsongs wrote: post #158
bergheim wrote: post #155

Earlier quoted context omitted.

Ah. Where did you send this in? I wouldn't mind sending in a complaint to both BankID (allow biometric login) and of course DnB corpo edition.

Oh! Sorry, you described the current state of things so well I assumed you were close to the project. Here is the github repo where banking app compatibilities are tracked: https://github.com/PrivSec-dev/banking-apps-compat-report And it's rendered to a page here: https://privsec.dev/posts/android/banking-applications-compa...

Hah - both were in my browser history, yes I know them :) I misunderstood and thought you had sent direct emails to relevant parties arguing for why they should be allowed on grapheneos.

Thanks anyway!

Re: GrapheneOS – Break Free from Google and Apple

#170

Post by bergheim »

b112 wrote: post #163
fodmap wrote: post #142

Earlier quoted context omitted.

> It's mind boggingly stupid that they lock down apps like this, when you can just open the thing in a website anyway. I can use my bank on some linux distro... Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I have several linux phones but I can only do banking with their…

Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I've seen this elsewhere, and it's absolutely ridiculous. Why? Because in almost all cases, the apps may only be installed with Google Play, and require the framework to work correctly. And that means? If you are not in good s…

Especially with how things are currently, I whole heartedly agree - you cannot operate as a human being in Europe without having a good standing with either Alphabet or Apple.

Absolute madness.

Post reply on HN