Live data from Hacker News

GrapheneOS – Break Free from Google and Apple

blog.tomaszdunia.pl

201–210 of 967 posts

Re: GrapheneOS – Break Free from Google and Apple

#201

Been using this for about a year on a p9 pro. It works very well. I hear the google tap to pay does not work, but I've never tried it. However Vipps with their tap to pay works fine. BankID works but not with biometric login, which some things require IIRC. And for some reason DnB private works fine, but you are not allowed in on the corp app. It's mind boggingly stupid that they lock down apps like this, when you ca…

> when you can just open the thing in a website anyway. I can use my bank on some linux distro

Unfortunately not.

I'm in the UK. Two of my personal banks, all four business banks that I need to use, and several credit cards, require authentication using their phone app to confirm login on their website.

None of those I've seen are using TOTP or SMS, for which I could use a general security service. All use their own phone or tablet app. One does something interesting where the website shows a unique QR code on each login, the phone app reads it with the phone camera, and then website login proceeds instantly without clicking anything.

Oh, and some of them also require phone app confirmation for card purchase transactions.

When my last phone's screen stopped working, I called one bank's "phone banking" line (using another phone of course) to make an urgent transaction, and they told me they can't do that, as only service they offer by phone is registering a new phone or tablet. They told me explicitly that it's not possible to login to their web-based banking service without using their app for authentication, and on a registered device.

It's the reason I have my current phone. I had to buy a cheap-ish Android in a hurry from a local shop, in order to proceed with my bank transaction.

Back to the main topic: I love the idea of a properly open source phone, I used to own not one but two Nokia N900s, and I once toyed with the idea of building my own Linux phone from scratch, big project though that is.

But the security ecosystem around logins has changed, and so have the services I depend on. These days I use many bank and other financial-service related apps, and I'm not, in practice, free to switch providers. So I couldn't use a Nokia N900 or modern equivalent any more as my only mobile device. I'd have to carry a second phone as well.

(Banking and other service authentications are also the only reason I have my current passport. I resented having to pay to renew my expired passport, given I had no plans to travel (small children) and the expired passport used to be accepted, but I found some banks, credit cards and even government services increasingly requiring to see a non-expired passport from time to time. When I asked one of them what do they do for the large number of people who don't have one, they simply told me they close those people's accounts and that's ok, they don't need to serve everyone. But that's another story.)

Re: GrapheneOS – Break Free from Google and Apple

#202

I personally tend to own two Phones. One all-day carry GrapheneOS device (Pixel 8) and an older WiFi and at home only iPhone for all payment and ensurance stuff. This is inconvenient in some ways, but at least it is sort of privacy as good as it gets while still being able to run official apps when I need them at home. To de-google the phone, I use F-Droid as primary App store, Aurora as fallback for non-f-droid Apps…

Some other FOSS apps I use daily:

Aegis - 2FA (https://github.com/beemdevelopment/Aegis)

Breezy Weather - A very good looking weather app (https://github.com/breezy-weather/breezy-weather)

OnlyOffice Documents - MS Office suite replacement (https://github.com/ONLYOFFICE/documents-app-android)

Fossify Calendar (https://github.com/FossifyOrg/Calendar)

Fossify Messages (https://github.com/FossifyOrg/Messages)

Aves - Local gallery with great organization (https://github.com/deckerst/aves)

Termux - Terminal emulator (https://github.com/termux/termux-app/)

Unexpected Keyboard - A unique keyboard that pairs nicely with Termux (https://github.com/Julow/Unexpected-Keyboard)

WG Tunnel - WireGuard client (https://github.com/wgtunnel/wgtunnel)

These are all easily installed through Obtainium: https://obtainium.imranr.dev/

Re: GrapheneOS – Break Free from Google and Apple

#204

And once you are on GrapheneOS, break free from your proprietary watch ecosystem and switch to GadgetBridge ( https://gadgetbridge.org/ ) I run a Thinkpad with NixOS and KDE, a Pixel 9 with GrapheneOS, and an Amazfit watch paired with GadgetBridge on my phone. It's a testament to the hard work of the FOSS maintainers of these projects, and the spirit of open source, that everything works flawlessly together without a…

> And once you are on GrapheneOS, break free from your proprietary watch ecosystem and switch to GadgetBridge

Then switch back to Google/Apple after half a year when you discover that you can’t run

- your banking app - any government app - the app required to access large sports events - the pandemic tracking app without which you can’t enter an airport - various other random apps

because they ALL detect that you’re running on a phone with an unlocked bootloader and will flat out refuse to start. And for many of those, there is no legal alternative.

(The extent of this varies depending on where you live, of course.)

Re: GrapheneOS – Break Free from Google and Apple

#205

And once you are on GrapheneOS, break free from your proprietary watch ecosystem and switch to GadgetBridge ( https://gadgetbridge.org/ ) I run a Thinkpad with NixOS and KDE, a Pixel 9 with GrapheneOS, and an Amazfit watch paired with GadgetBridge on my phone. It's a testament to the hard work of the FOSS maintainers of these projects, and the spirit of open source, that everything works flawlessly together without a…

Garmin watches seem quite open even without that. I have all my data syncing to influxdb every 15min for a Grafana dashboard and it works great.

In background I also have Withings scale sync the measurements a couple of times a day to Garmin.

Re: GrapheneOS – Break Free from Google and Apple

#206

Earlier quoted context omitted.

Oh! Sorry, you described the current state of things so well I assumed you were close to the project. Here is the github repo where banking app compatibilities are tracked: https://github.com/PrivSec-dev/banking-apps-compat-report And it's rendered to a page here: https://privsec.dev/posts/android/banking-applications-compa...

Hah - both were in my browser history, yes I know them :) I misunderstood and thought you had sent direct emails to relevant parties arguing for why they should be allowed on grapheneos. Thanks anyway!

Oh I also misunderstood! I did send an email to DNB Bedrift customer service about Graphene support, citing the private app fix. They technically gave me a response that it would be looked into, but it felt very handwavy, and that was 3 months ago. It was via the bedrift portal, there is a "Send E-Post" button.

I don't know how to contact the engineering team. IIRC that is how the private app got fixed, someone got word to someone on the inside.

Re: GrapheneOS – Break Free from Google and Apple

#207

And once you are on GrapheneOS, break free from your proprietary watch ecosystem and switch to GadgetBridge ( https://gadgetbridge.org/ ) I run a Thinkpad with NixOS and KDE, a Pixel 9 with GrapheneOS, and an Amazfit watch paired with GadgetBridge on my phone. It's a testament to the hard work of the FOSS maintainers of these projects, and the spirit of open source, that everything works flawlessly together without a…

I didn't need anything more on my to-do list, but this is intriguing.

Setting up GadgetBridge is very easy since it's just an android app. No flashing firmware etc. However, not all gadgets are equally supported, and you should check the support status of your device - https://gadgetbridge.org/gadgets/ (I bought my watch only after checking that page for compatibility).

Re: GrapheneOS – Break Free from Google and Apple

#208
post #205

And once you are on GrapheneOS, break free from your proprietary watch ecosystem and switch to GadgetBridge ( https://gadgetbridge.org/ ) I run a Thinkpad with NixOS and KDE, a Pixel 9 with GrapheneOS, and an Amazfit watch paired with GadgetBridge on my phone. It's a testament to the hard work of the FOSS maintainers of these projects, and the spirit of open source, that everything works flawlessly together without a…

Garmin watches seem quite open even without that. I have all my data syncing to influxdb every 15min for a Grafana dashboard and it works great. In background I also have Withings scale sync the measurements a couple of times a day to Garmin.

Probably the reason why Garmin watches are well supported by GadgetBridge

Re: GrapheneOS – Break Free from Google and Apple

#209

I personally tend to own two Phones. One all-day carry GrapheneOS device (Pixel 8) and an older WiFi and at home only iPhone for all payment and ensurance stuff. This is inconvenient in some ways, but at least it is sort of privacy as good as it gets while still being able to run official apps when I need them at home. To de-google the phone, I use F-Droid as primary App store, Aurora as fallback for non-f-droid Apps…

I like Organic Maps because it isn't full of the social things. Every time I open Google Maps it shows that card at the bottom with "what's popular in your area", full of pictures of people's breakfasts and other nonsense. Organic Maps is free of this noise. Also, the desktop client on Linux is quite useful. Alternatives for Windows etc. are Cruiser Maps, a Java application (and also available as an Android app).

Google maps discover feature is a dumpster fire for fomo driven brain fog

Re: GrapheneOS – Break Free from Google and Apple

#210
post #142

Been using this for about a year on a p9 pro. It works very well. I hear the google tap to pay does not work, but I've never tried it. However Vipps with their tap to pay works fine. BankID works but not with biometric login, which some things require IIRC. And for some reason DnB private works fine, but you are not allowed in on the corp app. It's mind boggingly stupid that they lock down apps like this, when you ca…

> It's mind boggingly stupid that they lock down apps like this, when you can just open the thing in a website anyway. I can use my bank on some linux distro... Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I have several linux phones but I can only do banking with their…

> Not in Spain. I can access my bank's website but I can't do anything without their bank app.

I don't know about Spain specifically, but as far as I understand it no bank in the European Economic Area + UK should allow banking via just the website alone anymore, because of the "Revised Payment Services Directive" (PSD2) regulation.

Essentially, banks are required to implement "strong customer authentication", which in essence is just multi-factor authentication with a password + either biometrics or a security device of some sort.

And in practise that means a banking app, because most people do not want a separate token they have to buy and can lose. Though a lot of banks do offer those as well.

Post reply on HN