so whats stopping a realFOSS fork of android? are boot loaders locked? too much diversity? do we need to buy one of those phone farms used by botters?
Android is almost dead – OSnews
31–40 of 41 posts
Re: Android is almost dead – OSnews
#32Earlier quoted context omitted.
> as part of legal requirements that exists, namely for financial and banking applications. Please cite the laws or regulations you’re referring to, because I don’t think there are any.
PCI-DSS (enforced by banks/payment processors) means the EMV token store on your Android phone must be in an isolated uncompromised location (usually the TEE). If your phone is rooted or has an unlocked bootloader then it's possible that trusted store is no longer secure or can be snooped on by a third party. Given Google Wallet/Pay handles EMV tokens and stores them on the phone, it has to pass PCI-DSS before banks…
Okay, so you were mostly referring to payment industry standards, not laws or regulations.
> PCI-DSS (enforced by banks/payment processors) means the EMV token store on your Android phone must be in an isolated uncompromised location (usually the TEE).
Do you have a citation for this? My understanding is that the whole point of EMV tokenization is that it masks the sensitive cardholder data that would otherwise have to be protected in a PCI compliant way. In other words, I don’t think the data that is stored on your phone is covered by PCI-DSS.
And as another poster already mentioned, I don’t think the EU law you’re citing works the way you claim it does.
Re: Android is almost dead – OSnews
#33Doubt it as google push Android and Android is said to have a better camera than apple..but stats show 50/50 between two
Re: Android is almost dead – OSnews
#34so whats stopping a realFOSS fork of android? are boot loaders locked? too much diversity? do we need to buy one of those phone farms used by botters?
FOSS fork of Android is useless without hardware capable of running them. Which means you need hardware manufacturers and telecom companies on your side.
Re: Android is almost dead – OSnews
#35Earlier quoted context omitted.
> You also have the EUs Payment Services Directive (so a law) which require strong customer authentication, rooted devices can also fail up here. Plain wrong. PSD3 does not apply to "digital wallets" [1] ("This Directive also does *not* cover, in its scope, the provision of technical services including processing or the operation of digital wallets."). > If your phone is rooted or has an unlocked bootloader then it's…
> Even with a rooted phone you can't mess or snoop on data in the trusted execution environment A rooted phone can have a modified runtime/kernel that can inject code into whatever processes it sees fit, including Google Pay. Which can expose information being sent to and read from the TEE by the app. > Plain wrong. PSD3 does not apply to "digital wallets" [1] ("This Directive also does not cover, in its scope, the p…
> A rooted phone can have a modified runtime/kernel that can inject code into whatever processes it sees fit, including Google Pay. Which can expose information being sent to and read from the TEE by the app.
You seem to have now realized (?) you can't modify or see data in the trusted execution environment from the host OS (rooted or not). Meaning the point you made earlier: "means the EMV token store on your Android phone must be in an isolated uncompromised location (usually the TEE)." is not affected by your phone being rooted.
So you have shifted your argument from "the store is unsafe" (false) to "the data in transit to the app might be observable". PCI-DSS doesn't require you to have something like Google Play Integrity API for that.
> The legislation still applies to the bank behind Google Pay.
You started out with that the Google Play integrity API was a hard requirement to comply with legislation (false). Sure, banks are still responsible for fraud under that legislation. But that is a very broad statement which doesn't require Google Play integrity API. GrapheneOS proved you can do attestation in an open way. Google just chose to do it in a way which ties you to Google and further locks down the Android ecosystem.
Re: Android is almost dead – OSnews
#36so whats stopping a realFOSS fork of android? are boot loaders locked? too much diversity? do we need to buy one of those phone farms used by botters?
Nothing they will continue to work just like before, this is only an issue if you include the proprietary rootkit that is google play services.
Re: Android is almost dead – OSnews
#37I really don't see how Google will make Samsung and the big Chinese Android phone manufacturers (Xiaomi, OnePlus, ...) put this crap on their own custom Android distributions, especially because all these guys know that if they do it will have a very severe cost -- Besides Play and the Galaxy Store F-Droid is probably the third most popular distribution channel for Android apps on Galaxy devices, for example. So I do…
> So I do think the only people who will be really affected by this are those running Google's own Pixel devices which are entirely locked into the Play ecosystem. The rest not so much.
Ironically its the opposite because Google's Pixel series are relatively open and thus its possible to install Android forks (GrapheneOS, LineageOS) without Google Mobile Services that contain ADV
Re: Android is almost dead – OSnews
#38so whats stopping a realFOSS fork of android? are boot loaders locked? too much diversity? do we need to buy one of those phone farms used by botters?
FOSS fork of Android is useless without hardware capable of running them. Which means you need hardware manufacturers and telecom companies on your side.
Google Pixels are open ;)
Re: Android is almost dead – OSnews
#39I lost a lot of sympathy for these campaigns when they started to use hyperbole. ADV is not a virus, nor a trojan horse. > killing the ability to install your own software on your phone But you can still install whatever you want over ADB...
> But you can still install whatever you want over ADB... ...if you wait 24 hours. And also thanks to the new Google Play attestation API a lot of apps won't even work on alternative Android OS'es. But that's all needed in the name of security. Never mind if your Samsung Galaxy phone is EOL and hasn't been receiving updates for 4 years anymore. It still works with the attestation API. But the fully updated GrapheneOS…
> And also thanks to the new Google Play attestation API a lot of apps won't even work on alternative Android OS'es.
Tbf to Google, AFAIK they aren't forcing third party app developers to enforce Safetynet/Google attestation.
Re: Android is almost dead – OSnews
#40Earlier quoted context omitted.
FOSS fork of Android is useless without hardware capable of running them. Which means you need hardware manufacturers and telecom companies on your side.
Google Pixels are open ;)
Except Google is the very company progressively shutting out open source efforts out of the Android ecosystem.