GrapheneOS (@[email protected])
grapheneos.social
@[email protected] The initial devices with GrapheneOS support should be available in 2027. The initial devices will be flagships so they'll be higher end hardware than Pixels at a higher price. Lower end devices will take more time to meet our requirements since the updates and security features aren't as good. It's mostly due to how Qualcomm handles it. The latest Snapdragon flagships have the best security features. We'll also need Motorola to start paying them for longer updates below flagships.
  • Crit@lemmy.wtfEnglish
    5·
    16 days ago

    There are basically 3 types of OSs out there:

    • Google-approved android (these come with Google apps, and most importantly Google services, which are basically what is going to BD doing the blocking for the cause Keep Android Open is concerned about. Google services already has some additional attestation stuff in, which many banks use, which only work if you’ve got a stock google-approved OS)
    • Non Google approved android (generally based on AOSP which is the actually open source code Google publishes for android, these don’t come with google services so they fail the play store attestation, generally people will be needing microg to use stuff like YouTube, which is basically a light google services replacement)
    • Graphene OS (it gets its special category because it sandboxes apps so you can use Google services apps in a way that doesn’t give them access to the rest of your system and therefore shouldn’t be able to mess with what you want to install, best of both worlds but it’s not foolproof).

    There are a few other projects like /e/ but that’s just AOSP with a coat of paint, graphene is a much more substantial change to how your phone locks down app access.

    • AlteredEgo@lemmy.mlEnglish
      2·
      16 days ago

      So does microG work good enough to run banking apps? That’s really the big question for most I think.

        • AlteredEgo@lemmy.mlEnglish
          2·
          15 days ago

          Thanks. Well surprisingly even banking should be working, except one “broken” review for the latest version.

      • Crit@lemmy.wtfEnglish
        21·
        15 days ago

        Not really cause you need to patch those apps to support microg instead afaik, at least you do with YouTube, and banking apps probably have ways to check if they’ve been meddled with.

        To expand on that if you’re curious, there are afaik 2 types of attestation to verify it’s a safe device, device attestation (which checks for a locked bootloader and some specific fingerprints), this is safe to fake for custom roms. The other one is the one i mentioned done through the software side with Google play services and such. That’s impossible to fake currently (afaik, been a minute since I could install a custom rom).

          • Crit@lemmy.wtfEnglish
            2·
            15 days ago

            It’s really Google’s fault for implementing this, the banks do get some of the blame for using it too when it has nothing to do with security though.

    • MonaySimpson@lemmy.mlEnglish
      1·
      14 days ago

      Yes. But the dev lockout stuff that Google is forcing will apply to all three. As I understand it.

      • Crit@lemmy.wtfEnglish
        1·
        14 days ago

        It works through the Google play services afaik so it won’t.

        • MonaySimpson@lemmy.mlEnglish
          1·
          13 days ago

          Thanks.

          It seems that

          The rule only kicks in on devices that come loaded with Google’s own apps and services, known as Google Mobile Services or GMS.

          That said, LineageOS flagged one gap worth watching which is if someone sideloads a third-party Google Apps package onto their device, that package could theoretically include the verification system bundled in

          I wonder of we’ll see more banking (and other) apps lockout ROMs that don’t have GMS, or bundle it in when installed on something like gOS.