Uncomfortable Questions About Android Developer Verification • Hacker News Board

Re: Uncomfortable Questions About Android Developer Verification

#181

Post by subscribed » Wed, Aug 27, 2025, 9:09 AM UTC

t_mahmood wrote: post #135

rattyJ2 wrote: post #73

Earlier quoted context omitted.

I could be one of the people running an ungoogled phone, but my bank refuses to have an app that runs on an ungoogled OS for "security"

My bank blocks my mobile with Lineage OS, and it's not even possible to login to the web site without the mobile app. Absolutely pathetic. Now I have to keep my 4 year old phone with 2 year outdated Android to access the bank application. Which deemed more safe then my mobile with latest security updates. Haha

It's even better than that. Banks (for example Revolut) consider several years old phones, running ancient OS (last I checked they allowed A10) without security updates for some 7 years, so riddled with zero-click/RCE vulnerabilities, but they do not allow GrapheneOS, which is currently the safest OS in mobiles (on par/beating iOS, depending whom you ask).

Yes, banks* claim phones riddled with maximum severity security issues are secure. Also phones that are rooted but using magisk modules to conceal this fact, and use spoofed signatures from ancient hardware, but the most safe platform is not secure enough for them.

Go figure.

*not all, there are notable exceptions explicitly supporting secure platforms through the modern Hardware Attestation model.

Re: Uncomfortable Questions About Android Developer Verification

#182

Post by scheeseman486 » Wed, Aug 27, 2025, 9:10 AM UTC

preisschild wrote: post #98

dns_snek wrote: post #44

Earlier quoted context omitted.

Android is a proprietary operating system developed by Google. Try running your "free" modified AOSP in the real world, on a real device, like a real person would and see how far you get before being blocked and restricted due to hardware attestation.

I have been running AOSP-based LineageOS and now GrapheneOS for more than a decade now. While some apps are restricted to Google-certified operating systems, most are definitely not. I can use my countries eID apps and my banking app without issue. The only thing not working is nfc payments (since they are limited to Google Wallet)

It doesn't matter if it's only some apps if those apps are critical. MyGov in Australia for example requires Play Integrity or it crashes. Your government's app does not... for now.

The grip of Google, Microsoft and Apple are tightening. Microsoft's TPM requirements for Windows 11 are ostensibly for security, but they're also a mechanism to enforce hardware/software integrity and authentication. Google wants to extend their integrity APIs to Chrome and I doubt Microsoft would object to implementing something similar.

Soon enough computing and the web may end up segregated, with there being devices authenticated and controlled by a central authority and those that are not. In a lot of ways this is already the case, I can't access the 4K Netflix streams I'm paying for on Linux because of DRM and using anything other than stock Chrome can often get you flagged for annoying captchas. But it can get so much worse than that.

Re: Uncomfortable Questions About Android Developer Verification

#183

Post by numpad0 » Wed, Aug 27, 2025, 9:10 AM UTC

teekert wrote: post #19

userbinator wrote: post #5

This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile. "debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read , 1997

Why is it so complex to have a foss mobile OS. I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that). For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in…

Because PC is an American thing but phones are not. Obsession for standardization, modularity, and cross-compatibility are rather unique American cultural traits that aren't nearly as strongly manifesting elsewhere. "Fits right in" is quintessentially American thing.

The entire unitized jet engines on Boeing aircraft drops right off and swaps right into another host, sometimes even to different types of aircraft. PCI soundcards come off a i386 PC and go straight into PPC Macs. AR15 pressure bearing parts don't merely interchange between examples from different time and place but its grip and stock mounting patterns are becoming a industry standard of its own. Early Tesla battery packs come apart into bunch of 18650s and could reassemble into new packs(though it's a big no-no due to RUD risks). Meanwhile, Prius power units or front seats are for Prius only; it won't go into dozen different Toyota models, at least without substantial parts changes, modifications, and reconfiguration. Bugatti Veyron uses its own custom tires that aren't even forward or backward compatible with their own successor.

Same for phones: .apk runs everywhere, Linux do not, cameras don't interchange, internal connectors don't fit together, LCDs specific to anything are default unobtainium. microSD cards works on everything, but the moment you look away, Huawei invents a new incompatible format for absolutely no reason. Apple "reinvents everything" every time but internal organizations of components are stable at macroscopic levels for few generations unlike most other manufacturers.

It's openness of PC that is unique and precious, not closed nature of everything else being odd and inconvenient.

Re: Uncomfortable Questions About Android Developer Verification

#184

Post by subscribed » Wed, Aug 27, 2025, 9:15 AM UTC

aspenmayer wrote: post #163

preisschild wrote: post #92

Earlier quoted context omitted.

Write them. My bank's app had safetynet, but they disabled it and now it is usable over GrapheneOS. Unfortunately no NFC Payments though, since they are only available for Google Wallet (which uses safetynet)

> Unfortunately no NFC Payments though, since they are only available for Google Wallet (which uses safetynet) A workaround for NFC payments I've heard about for folks running OSes on their Androids that don't support that feature is a smartwatch with NFC.

Precisely. Google pixel, Garmin watches, even Samsung watches.

Or using a bank that supports NFC payments (not using Google Wallet).

GrapheneOS Foundation raised this practice with European Commission because it unfairly penalises secure and safe competition giving instead a lie to the developers and banks that ancient, unsafe, vulnerable platforms are more secure.

Re: Uncomfortable Questions About Android Developer Verification

#185

Post by PeterStuer » Wed, Aug 27, 2025, 9:18 AM UTC

teekert wrote: post #19

userbinator wrote: post #5

This shouldn't just be "questions"; this should be a full-on opposition. Do not give them even an inch, or they'll take a mile. "debugger vendors in 2047 distributed numbered copies only, and only to officially licensed and bonded programmers." - Richard Stallman, The Right to Read , 1997

Why is it so complex to have a foss mobile OS. I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that). For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in…

Because the baseband chipset protocols and drivers are extremely patent encumbered. Any FOSS project will have to rely on on proprietary blobs for this part, and licensing deals from the existing patent holders, Quallcom. Nokia, Ericsson etc. .

You can see this is sort of adverserial to the FOSS way of doing things.

Re: Uncomfortable Questions About Android Developer Verification

#186

Post by sureglymop » Wed, Aug 27, 2025, 9:18 AM UTC

whs wrote: post #14

I used to run Shizuku for my phone to run Hail (an app suspension tool). Now that my credit card bank start checking for USB Debugging I stopped using the app (and now my 3DS OTP has to be over SMS). I believe there's only two banks left in Thailand that do not check for one and it is just a matter of time, because any time these banks could have hired any of those "security" people who will ask why don't we block th…

It's your device and you should be able to do what you want. I do want to point out though that in your specific case, your use of such tools, whether Shizuku or Dhizuku does actually affect the security of your device and could easily be exploitable. And yes, even lending the DeviceOwner permission to another app temporarily is not great...

However, it's problematic if the banking apps also block regular configurations on something like GrapheneOS, e.g. by inspecting the initial call stack of an app. There are many such trivial to bypass ways of doing root detection and most are easily circumvented anyway.

Re: Uncomfortable Questions About Android Developer Verification

#187

Post by spaqin » Wed, Aug 27, 2025, 9:20 AM UTC

maximilianthe1 wrote: post #159

mschild wrote: post #156

Earlier quoted context omitted.

Why does a gas station need an app?

Bonus/loyalty programm

More likely getting data on your usage in some part, or most likely, pushing notifications reminding you about the particular brand, so you'll keep spending the money there.

Re: Uncomfortable Questions About Android Developer Verification

#188

Post by Nextgrid » Wed, Aug 27, 2025, 9:24 AM UTC

maximilianthe1 wrote: post #150

SanjayMehta wrote: post #110

Earlier quoted context omitted.

My bank used to block VPNs “for security reasons.” Now they very kindly just display a warning.

Gas station app I use asks to turn VPN off every launch (even when it is disabled)

It’s likely incompetence than malice. Chances are they’ve had a lot of customer complaints because some popular free VPN interferes with their app, and adding a blanket warning about VPNs is easier than trying to figure out why it’s not working and fix it.

Re: Uncomfortable Questions About Android Developer Verification

#189

Post by vczf » Wed, Aug 27, 2025, 9:26 AM UTC

positron26 wrote: post #66

teekert wrote: post #19

Earlier quoted context omitted.

Why is it so complex to have a foss mobile OS. I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that). For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in…

Mobile OSs are very consumer focused. I have criticized the FSF for, in there lengthily argued ways, abandoning the consumer. You have to commercialize openness if you want the muscle of the consumer to be able to produce it. Short presentation of the basic concept: https://youtu.be/SO46oEdlkY8 Some things with massive value in excess of the cost of production cannot be pursued by capital nor bought by the individual…

That's a very clear vision on how to solve this kind of funding/cooperation problem outside of government and mission-focused nonprofits. And incidentally would be an existential threat to surveillance capitalism should it reach critical mass.

BTW your password-based signup flow isn't working (on iOS Safari at least).

Re: Uncomfortable Questions About Android Developer Verification

#190

Post by AnthonyMouse » Wed, Aug 27, 2025, 9:30 AM UTC

Perz1val wrote: post #140

teekert wrote: post #19

Earlier quoted context omitted.

Why is it so complex to have a foss mobile OS. I only have Linux PCs (laptops) and servers, 100% of my work and personal stuff is done there (though for work I do need to hop into MS365, Google Workspace, Zoom, etc, hooray for browsers, my final firewall between me and the walled gardens, though we can have a whole discussion on that). For mobile, we have PostmarketOS, Phosh, Ubuntu Touch. I really must try living in…

As Microsoft how is it so difficult to have a mobile os

Microsoft has the problem that nobody likes them or trusts them, which makes it hard to get people to use their platform in a context where they're not the default.