RetroFed
No banking apps on your custom ROM? This new initiative could help.
submitted by
Sahwahttps://www.androidauthority.com/custom-roms-unifiedattestation-play-integrity-3647852/
A new European initiative dubbed UnifiedAttestation aims to build a free and open-source alternative to Google’s Play Integrity checks. The initiative is backed by smartphone maker Volla, while other partners include /e/OS maker Murena and the team behind iodé OS. The feature will be distributed under an Apache 2.0 license.
Share on Mastodon
Share on Reddit
Share on WhatsAppANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_1FAEFB6177B4672DEE07F9D3AFC62588CCD2631EDCF22E8CCC1FB35B501C9C86
GrapheneOS is not a fan of this.
https://grapheneos.social/@GrapheneOS/116200110686604617
Jeez. They really don’t. And, I guess they shouldn’t. Their stance is that device certification shouldn’t be necessary in the first place which I agree with considering this is not done for computers (don’t do this tech bro shitheads).
It is to some degree, with the TPM. Microsoft Surface laptops come to mind.
Actually i have been thinking about it and i do believe that it should be done for computers, actually. Like, an attacker could super easily steal your login credentials when they get 10-15 minutes with your computer once. They could do that by booting a custom OS, modifying some of your operating system’s system files to install a keyboard tracker or sth, and then just wait for you to enter your password.
I believe it’s actually why some banks i know don’t allow login anymore if you’re not using their Android apps to verify the login.
Yea, i know no bank that allows login in browser with only basic auth. All use some proprietary 2FA app with fancy QR codes (colour pixel or similar). Funnily, many banks then offer SMS based 2FA in order to restore…
Like make hard and secure login but reset option is old SMS thingy spoofable since… ever?
Bank apps are the worst. So much SMS 2FA. Faux security. Fuck banks.
Ally, capital one, chase support browser login with basic auth, and sometimes SMS 2fa. I’ve never used a mobile bank app
Personally really wish capital one would add authenticator 2FA… Neither app nor site has it
I’m I’m surprised they don’t allow 2fa with like bitwarden or passkeys
At this point it’s like an unwritten rule of the internet that every GrapheneOS account comment chain will eventually regress into cooker conspiracy theories about other privacy ROM projects. And I still have no idea why Micay has started lumping iodé in with them, because I have been following that project closely for many years and no one there gives a shit about GrapheneOS. As in, they literally do not talk about Graphene (or any other projects, for that matter). They never compare themselves to GrapheneOS, on security or anything else. It’s the most bizarre, one-sided internet war.
The Graphene devs and user base behave like a cult
Because that dude is nuts. He does a disservice to graphene PR anytime he speaks.
I don’t know, but it seems to me that you might have a rather good guess as to why right there.
???????????????
It’s quite common for people to feel hurt when they feel ignored.
Oh sorry, I think I misunderstood you initially.
I’m baffled. It’s almost as though they’re missing the point of attestation: which is to give “assurance” to application developers/companies that their applications run in “a certain way”.
“A certain way” can have many interpretations, but Googles interpretation means:
iodéOS will have their own definition of what “a certain way” is. Which will probably be identical to Google definition.
Heck, GrapheneOS’ attestation has it’s own definition of a “certain way” applications run:
I know this, because I run Graphene and I run it rooted. I sign my rooted Graphene with keys, that only **I carry and I have my phone setup to only allow OS updates with only my keys.
It does not and will not pass Graphene’s attestation, although from my perspective - it meets my security requirements while give me control over my data.
This discussion has nothing with security patches, but everything to do with the accuracy and how much information developers and companies can get off our devices.
Yeah whatever. They are their own bubble.
They’re not wrong though
They are if banks don’t allow their apps to be functional on grapheneos.
I have never had an issue with banking apps so long as exploit compatibility mode is enabled for them.
I appreciate the effort but my banking apps still rely on 2FA through SMS. They aren’t interested in implementing a technology that is more secure or even one that is different than what they have already, especially for a fraction of a fraction of a fraction of their user base.
And you trust them with your money!?!
Fair point but I am not going to do all my shopping exclusively out of catalogs and mail in my payment with cash.
Its a shitty situation but short of government regulation (ha) nothing is going to change.
Are there no other banks in your area?…
Yes and as far as I can tell, they all have that as their system. Also the changing of the password every quarter which has proven to actually decrease password security and increase password reuse.
I should say, if anyone knows a bank with proper modern online security protocols I am willing to listen.
Fidelity. https://www.fidelity.com/security/extra-security-login
Revolut
I’m personally quite fond of Wise.
Seriously, this shit should be illegal already
this old initiative could help: browsers
Right? Why put all these apps with extra trackers on your shit anyway?
This is what I used to do until my bank stopped supporting Zelle on the mobile website.
This older initiative can help: Pay cash for everything
this older initiative can help: dont pay
This older still initiative can help: lie down in the forest and become one with the moss.
Open source DRM is still DRM