GrapheneOS attestation compatibility guide
grapheneos.org
Guide on using remote attestation in a way that's compatible with GrapheneOS.

cross-posted from: https://slrpnk.net/post/15995282

Real unfortunate news for GrapheneOS users as Revolut has decided to ban the use of ‘non-google’ approved OSes. This is currently being posted about and updated by GrahpeneOS over at Bluesky for those who want to follow it more closely.

Edit: had to change the title, originally it said Uber too but I cannot find back to the source of ether that’s true or not…

  • Andromxda 🇺🇦🇵🇸🇹🇼@lemmy.dbzer0.comEnglish
    29·
    6 days ago

    I don’t think it’s a coincidence that the shittiest companies are those, who enforce Google’s broken and monopolistic “Play Integrity” API. Revolut has connections to Russia, McDonalds supports the Israeli genocide in Palestine and Authy has always just been a massive piece of shit, not even allowing users to export their TOTP seeds. These are three companies I would NEVER even consider using anyway.

    And “Play Integrity” API actually does NOTHING, absolutely NOTHING for your security as an end user.
    You use an outdated, unpatched Android version with multiple severe, publicly known exploits on an insecure device?
    Google doesn’t give a single fuck.
    You use the newest version of Android with all the patches applied on Google’s own hardware, with a locked boot loader and a hardened operating system?
    That’s not allowed by the “Play Integrity” API.
    It’s only purpose is to serve Google’s monopolistic business interests.

    • 4lan@lemmy.world
      6·
      5 days ago

      It’s crazy how they can just do illegal things because they have so much money…

      Do I own my phone or not??

        • theroff@aussie.zone
          3·
          5 days ago

          Graphene shills have been banging on this point for donkey’s ages. Reality is that many people use phones that are out of OEM support and many OEM ROMs are bundled with questionable software (Oppo, Samsung etc.) There are some decent criticisms to be made about LineageOS, but others to be made about Grapheme, like its Google-suggestive configurations, which is quite bad for security and privacy. Graphene says this is all optional and not part of the OS, but doesn’t include any equivalent F-Droid installer.

          • DoeJohn@lemmy.world
            2·
            4 days ago

            Yeah. As much as I love GrapheneOS and all the security work, sometimes I feel like their “ideal” setup is to just install GrapheneOS on the latest Pixel phone and use only the 5 or so built in apps, as everything else is insecure, brings additional code baggage and can introduce flaws. I don’t think anyone can live like that.

  • ouch@lemmy.world
    12·
    5 days ago

    Google has ruined Android by closing it up.

    EU needs to step in and force Google to open it up.

    While at it, go for Apple’s monopoly as well.

  • Anivia@feddit.org
    58·
    7 days ago

    Time to switch away from Auth I guess. Not even using GrapheneOS cause I have a Samsung phone, but this is not acceptable

  • Roopappy@lemmy.world
    27·
    6 days ago

    Why would anyone load an app from McDonalds? You want to give them elevated access to your most personal data for a few dollars of coupons?

    What are they taking from you that’s worth more than the discounts they are giving you? Because they are definitely making a profit, or they wouldn’t be doing it.

    • Sips'@slrpnk.netOP
      14·
      6 days ago

      We are definitely in the era where people think discounts before user privacy. I bet most of people downloading the Mcdonald app do it exactly because of cheeper prices and easy of access.

      • dharmik@linuxusers.in
        21·
        6 days ago

        just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.

      • dharmik@linuxusers.in
        11·
        6 days ago

        just had medium fries and coke. many people i know, including myself, use the mcd app because of the discounts it offers when ordering through the app. however, i am under the impression that since i use an ios device and have the option to decline being tracked by the app—which i very eagerly press “no” to—i am on the safe side. am i?

        • pound_heap@lemm.ee
          6·
          6 days ago

          Apple does extensive audit of mobile apps, including limitations of tracking. So the app cannot spy on something you are not letting it to know. But you are giving it a bunch of info voluntarily.

          I’d say using that app on iOS is similar to making a food delivery order using a loyalty member ID. Basically, you are letting the company (McDonald’s) know who you are, what is your phone number, where do you live, and what do you like to eat. And if they wish to, they could use all that to purchase your profile from a data brocker. Or they can sell that info for a few cents to make up on that discount.

      • dharmik@linuxusers.in
        11·
        6 days ago

        just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.

      • dharmik@linuxusers.in
        11·
        6 days ago

        just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.

      • dharmik@linuxusers.in
        11·
        6 days ago

        just had medium fries and coke. i and many i know use the mc D app because of the discounts it gives when i order through my app.

  • Dr. Moose@lemmy.worldEnglish
    18·
    6 days ago

    Authy has been utter garbage for a long time and if you ever needed a reason to migrate away then now is as good as ever.

  • BigDanishGuy@sh.itjust.works
    527·
    7 days ago

    OK McDonald’s, I will not use your most cost effective ordering method. I guess I will just have to order my 10 individually custom cheeseburgers at the counter instead. I might have to have e the order read back, and change my mind about a few burgers.

    • Railcar8095@lemm.ee
      1111·
      7 days ago

      As a former employee… That does nothing. Crazies that spend 15 min to order some fries were common.

      If you go at rush hour it can be annoying to the employee and other customers, but at the end of the day nobody will remember and you would have spent 20 min and 10 dollars (which is 9 dollars material profit for MacDonald).

      Just. Don’t. Go. To. Macdonald’s.

    • purplemonkeymad@programming.dev
      6·
      7 days ago

      I don’t know about other places but they haven’t had a counter for years round here. They have big screens that you go up to to order and pay, then you get a number and pick it up when called. Even if you wanted to do this, no one is going to listen to you trying to order at the kitchen.

      • boonhet@lemm.ee
        2·
        7 days ago

        Entirely different country, but they still have a counter in addition to the screens; the counter is for when you want to pay cash

    • bountygiver [any]@lemmy.mlEnglish
      72·
      7 days ago

      that’s just screwing with the workers though, and the workers sure as hell is not going to get paid extra for your custom order

      • Woht24@lemmy.world
        135·
        7 days ago

        This viewpoint is so stupid.

        The cashier is paid to take orders, whether they take 1 long obnoxious order or 3 small orders, it’s the same shit.

        People are so swept up in ‘kindness and support’ (internet circlejerking), they think that the fact you inconvenienced some 17 year old, representing a massive corporation, as a fuck you to the company that employs them, you’ve committed some moral sin against your fellow man.

        • neomachino@lemmy.dbzer0.com
          8·
          7 days ago

          That worker doesn’t want to be there, that’s likely one of 3 jobs they need to barely scrape by.

          You holding them up from doing other tasks they need to do to keep a job that barely feeds them is doing nothing but making their day a little harder. It affects the company 0%. The company is faceless and doesn’t care how much you abuse the worker bees as long as they get your money.

          I don’t know what the answer is aside from not patronizing the company at all, but I know that’s not it.

          • Lag@lemmy.world
            51·
            7 days ago

            If the company is always too busy, they will need to hire more workers or the existing ones will leave.

            • neomachino@lemmy.dbzer0.com
              3·
              7 days ago

              I highly doubt it, if the store is too busy they’ll likely either do nothing because why would they or if it’s really bad add some robots who can handle the workload so they can get rid of those pesky employees.

              In the past few years almost all of the fast food places in the closest plaza to me have been working on a skeleton crew. Lines wrapped around the building, 2 miserable employees, upset customers, but the money is still coming in.

              Most people can’t just leave their job, even a days wage can crush a lot of people.

          • UnderpantsWeevil@lemmy.worldEnglish
            2·
            7 days ago

            The company is faceless and doesn’t care how much you abuse the worker bees as long as they get your money.

            Hey now, sometimes the company employs security that’s extremely bored, incredibly racist, and looking for a low income punching bag to hassle.

            • neomachino@lemmy.dbzer0.com
              1·
              7 days ago

              Ahh how could I forget about the bored, racist, wannabe cops with nothing better to do. The perfect face to any modern company.

        • GHiLA@sh.itjust.works
          27·
          7 days ago

          the cashier

          Who is also the manager, making drinks, doing the fries because that bitch called in sick…

            • PrettyFlyForAFatGuy@feddit.uk
              1·
              6 days ago

              depends on the situation. otherwise good employee who rarely if ever is sick and works hard calls in about being unable to work? absolutely fine

              Person who i know knows exactly how many days a year over how many periods of absence it will take before HR get involved using it as a second pool of paid holiday days and leaving us high and dry to deal with the things she’s paid to help the team with then yeah, bitch

              her name was karen too…

              • Dragon Rider (drag)@lemmy.nzEnglish
                11·
                6 days ago

                Person who i know knows exactly how many days a year over how many periods of absence it will take before HR get involved using it as a second pool of paid holiday days

                This is a dick move if you don’t tell your coworkers how to exploit the loophole too, and a heroic act if you do.

  • AlecSadler@sh.itjust.works
    47·
    7 days ago

    This surprises me because McDonald’s app is hands down the worst app I’ve ever encountered in the history of all Android apps.

    It’s is sluggish, ignores touches/taps half the time, doesn’t adhere to Android best practices for flow, crashes a lot, errors a lot, etc.

    But OK McDonald’s. Fuck off.

    • ililiililiililiilili@lemm.ee
      4·
      7 days ago

      I can add that it requires location permission (even when you attempt to search manually with zip or city). What a shitty, dystopian timeline we are experiencing when we’re mandated to run privacy invasive spyware, just to get a fucking discount on nugs.

  • floreana@poliverso.org
    3·
    4 days ago

    @Sunny
    Gatekeeprs of wealth sticking together against the ambition for freedom of poorer people?
    Oh, color me surprised. 🙄

    (I want to de-Google step by step, thanks for the heads up).

    • Mike@sh.itjust.works
      17·
      7 days ago

      Unfortunately, this is probably because of the apps started using the Play Integrity API, which is a hardware-based attestation and can only be faked in two ways that GrapheneOS isn’t interested in:

      • you can fake an older device that didn’t support hardware attestation yet, or had a broken implementation
      • or you can try getting leaked vendor keys and emulate the crypto with those until they get revoked