cross-posted from: https://slrpnk.net/post/15995282
Real unfortunate news for GrapheneOS users as Revolut has decided to ban the use of ‘non-google’ approved OSes. This is currently being posted about and updated by GrahpeneOS over at Bluesky for those who want to follow it more closely.
Edit: had to change the title, originally it said Uber too but I cannot find back to the source of ether that’s true or not…
This makes me want to use GrapheneOS more. If the dataminers don’t want you to use it then it must be doing something right.
This is very bad news, because this means any app that wants your data could do the same.
On the other hand, it makes it easy to find which apps aren’t to be trusted with your data.
Also very obvious when an app or website have an US and an EU version. You just know they buttfuck the Americans because no rules.
Even Apple had to make two versions of iOS.
Maybe graphene will find a way into duping those apps to think you have a regular android phone?
Err, you could firewall an app from your data in Private Space or Shelter for older Android versions. That should work on any Android device.
Fuck both of these companies. Never used McDicks app in the first place. Spyware bullshit.
The mcdonalds app is a scam to get you to agree to their arbitration clause
Care to elaborate? I’m curious.
Never mind. I found an article pretty quick. Thanks for the heads up anyway. :)
Odd timing considering I’ve banned McDonalds, Revolut and Authy from my phone.
Just to be clear, they banned all custom roms, not only graphene.
It’s crazy how they can just do illegal things because they have so much money…
Do I own my phone or not??
Most ROMs like LineageOS and CalyxOS drastically weaken the security of Android, so that would actually make sense. GrapheneOS has far better security than AOSP, the Stock Pixel OS, or basically every other version of Android that you would find pre-loaded on a device. https://grapheneos.org/features#exploit-protection
Most ROMs like LineageOS and CalyxOS drastically weaken the security of Android
Source?
Graphene shills have been banging on this point for donkey’s ages. Reality is that many people use phones that are out of OEM support and many OEM ROMs are bundled with questionable software (Oppo, Samsung etc.) There are some decent criticisms to be made about LineageOS, but others to be made about Grapheme, like its Google-suggestive configurations, which is quite bad for security and privacy. Graphene says this is all optional and not part of the OS, but doesn’t include any equivalent F-Droid installer.
Yeah. As much as I love GrapheneOS and all the security work, sometimes I feel like their “ideal” setup is to just install GrapheneOS on the latest Pixel phone and use only the 5 or so built in apps, as everything else is insecure, brings additional code baggage and can introduce flaws. I don’t think anyone can live like that.
McDonalds? Uber?
They both have fully functioning webapps btw.
Right people who install various apps like McDonalds apps etc, are these even typical to GrapheneOS users? I’d think most would avoid superfluous data stealing apps.
I’ve been thinking of switching the GrapheneOS. I certainly enjoy my privacy, and are taking steps to move to sources that don’t harvest my data. Outside of YouTube and android I’ve completely degoogled myself, even replaced Maps with magic earth and OsmAnd. I even swapped full time to linux a handful of months ago as a gamer with a VR interest. But I’m not so hardcore to not use any service that might sell my data. I still use vanilla firefox, food ordering apps, and discord for example. So while I’m not someone who goes to extreme lengths to protect my data, moving over to GrapheneOS doesn’t seem like a huge inconvenience compared to the gains you get.
I switched to grapheneos on pixel 9 straight from iPhone. The only reason I have any google stuff on the phone is because of RCS messaging. There is literally nothing I have any issues with on this phone, software or hardware. It has been a very smooth and comfortable transition. I very much recommend giving it a try. I think you’d be surprised how little google (exclusively) gives, compared to how much they take.
Trackers I need find my to work. Well at least not spam everyone with a tracker is following you when my phone is also traveling with them.
If you already don’t use Google apps, and your bank app doesn’t ban graphene, there shouldn’t be any issues at all tbh
You can use this website to check if your banking app is supported: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
Sorry but it seems I might have been mistaken by calling out Uber on this one. Thought i read about Uber during this but I cant find back to it. Have changed the title.
It happens! And that list surely isn’t comprehensive.
I’ve been nagging my bank’s support to add the Graphene’s signatures, for example, no luck so far 😞
Do you mind sharing which bank you use?
Sofi
What do you mean webapp? Isn’t the app that you install a webapp? And isn’t a website not an app because you dont install it?
PWA - Portable Web App, Apple was going to make this the primary way to run apps but then decided an app store and private stuff was more profit and their support for it tends to be on the suckier side, but has gotten better over the years. You install a PWA in your browser by either “Install” or “Add to home screen” or something like that depending on browser and device being used.
by webapps they mean browser based apps.
Apparently not. I guess some apps you install in the browser. Which is an important distinction, if they’re using the word correctly
Yes both are PWA capable. However I stand corrected. The McDonalds webapp now redirects you to the play store when you try to order.
Guess they don’t want me as a customer. (Not that I’d eat McDonalds anyway).
riders.uber.com is fully functional though, I use it often
Try changing your mobile browser’s user agent to desktop
good point.
the problem here is not the banks or apps, the problem is Google Play Integrity API, which is supposed to enforce to run apps in secured phones and it is used to ban secured ROMs such as GrapheneOS and it allows to run apps on outdated phones without security patches.
which is supposed to enforce to run apps in secured phones
The point of the Google Play Integrity API is to ensure that the user is not in control of their phone, but that one of a small number of megacorps are in control.
Can the user pull their data out of apps? Not acceptable. Can the user access the app file itself? Not acceptable. Can the user modify apps? Not acceptable.
Basically it ensures that the user has no control over their own computing.
It’s simply the “secure” isn’t meant for users but the cooperations. Make it “secure” to their busibess.
It’s used to help secure the businesses app yes. It helps with things like preventing resource abuse which would cost the company money. E.g. querying mass amounts of data on a loop to increase the companies bill.
If you install GrapheneOS, you do not need root, so GrapheneOS is in control of the phone not the user. The key here is if GrapheneOS is secure enough to be certified by Google Play Integrity API. is it security or other issue? perhaps Google is not supporter of FOSS ROMs, perhaps it is not fun of how GrapheneOS removes permissions to Google Apps, …
If it is not security, this is a kind of monopoly to control which ROMs are allowed to run apps.
Can the user access the app file itself? Not acceptable
This is possible on any Android phone, no root or custom rom required
Oh, the banks and regulators are to blame. Especially in Europe.
Find me a PSD2 bank bank that doesn’t require a phone number
In this case, thanks to regulation, it seems GrapheneOS team is talking with European Commission about this problem with Play Integrity API https://fosstodon.org/@GrapheneOS@grapheneos.social/113623767380032309 and the only hope is a movement of the regulator against this policy of Google.
So the Play Integrity API is literally why I moved to iOS. My bank apps didn’t work with Lineage and the stock OnePlus ROM just sucked ass after the ColorOS or whatever update. I figured I might as well go iOS if I can’t have a custom ROM anyway, and so far it has indeed been a much nicer experience than stock Android. If you can’t TRULY customize everything, might as well at least get stability and consistency out of it, right? Plus at the time, there wasn’t a single Android OEM out there with truly long OS update support.
Anyway, if this succeeds and custom ROMs are considered to have sound integrity, I might just move back to Android. Graphene seems cool, I haven’t tried it yet because I’ve never owned a Pixel.
How would iOS be better? There is no blob-free, secure version on their devices at all. Right?
It’s not for privacy. But without access to custom ROMs, Android is shit.
Sure, but the ROMs is what makes Android a more secure platform
Sure, but my point was if you can’t even use ROMs because then you lose access to your bank (and now McD apparently), there’s much less reason to use Android - certainly was so 2.5 years ago when they were mostly all promising 2-3 years of support for flagship devices and Apple had a track record of 6-7 years.
Time to switch away from Auth I guess. Not even using GrapheneOS cause I have a Samsung phone, but this is not acceptable
Aegis is also nice
I don’t know if this is standard on all authenticator apps or not but I like the fact that Ageis makes you enter your password once in a while so you don’t forget it.
Switched to Ente Auth when Authy stopped having a free desktop version. What if I lose my phone? I want both my devices to have access to my codes.
Authy is no good anyway. Keeps codes hostage with no way to back them up. So many great open source alternatives
Give Aegis a try, it is great.
same. i wish i could run graphene or something similar on my moto G stylus. I wish my Pixel 6, 7 and 6a didnt all have defects. the 7 was my favourite.
Webapps everything you can like I do with Firefox and ublock origin. Fuck these assholes.
Not for Revolut. App only.
They do have a web app, it’s just very feature limited https://www.revolut.com/blog/post/introducing-the-revolut-web-app/
Like you can’t even pay people money kind of feature limited
not really. services make the mobile site unusable. example:
- facebook: nags you to use the facebook app with popups and large banners
- facebook messenger: does not even let you to log in
Fuck Facebook. I left that shithole in 2015.
I’ve done so similarly, but I can’t tell that to everyone I know if I don’t know an alternative that doesn’t have their friends
OK McDonald’s, I will not use your most cost effective ordering method. I guess I will just have to order my 10 individually custom cheeseburgers at the counter instead. I might have to have e the order read back, and change my mind about a few burgers.
As a former employee… That does nothing. Crazies that spend 15 min to order some fries were common.
If you go at rush hour it can be annoying to the employee and other customers, but at the end of the day nobody will remember and you would have spent 20 min and 10 dollars (which is 9 dollars material profit for MacDonald).
Just. Don’t. Go. To. Macdonald’s.
Just. Don’t. Go. To. Macdonald’s.
Best advice on the menu
Just stop eating at McDonald’s.
This kills the american
Probably for the best.
Unthinkable. He lives and breathes McDonald’s
They call it mackers in Australia
that’s just screwing with the workers though, and the workers sure as hell is not going to get paid extra for your custom order
I don’t know about other places but they haven’t had a counter for years round here. They have big screens that you go up to to order and pay, then you get a number and pick it up when called. Even if you wanted to do this, no one is going to listen to you trying to order at the kitchen.
Entirely different country, but they still have a counter in addition to the screens; the counter is for when you want to pay cash
But like, why?
This surprises me because McDonald’s app is hands down the worst app I’ve ever encountered in the history of all Android apps.
It’s is sluggish, ignores touches/taps half the time, doesn’t adhere to Android best practices for flow, crashes a lot, errors a lot, etc.
But OK McDonald’s. Fuck off.
It’s almost as if a clown programmed it
I can add that it requires location permission (even when you attempt to search manually with zip or city). What a shitty, dystopian timeline we are experiencing when we’re mandated to run privacy invasive spyware, just to get a fucking discount on nugs.
I can’t prove it, but I’m 99% sure Lyft did the same thing. Had a perfect rating (and was even a driver at one point), and they banned me without explanation right after I switched to GrapheneOS.
Emailed them a few times asking for the reason, and they refused to tell me.
_"Legally, we cannot release any additional information except that we found your account to be violating our Terms of Service.
We will be in touch if we are able to reopen your account in the future."_
There’s absolutely nothing else that they could’ve misconstrued as “violating the Terms of Service.”
If Uber’s going down the same path, no more ride-sharing for me I guess. ¯_(ツ)_/¯
Its machine learning fingerprinting. They lost the ability to fingerprint you, a flag was raised, and you’re b&
When this happens to half your accounts, that’s when you know you’re winning at not being tracked
Uber still works under Lineage. Can’t imagine what the heck they are trying to block
No idea. Gonna try to stick to the web app instead and hold off updating the native mobile app for as long as possible.
A valid excuse may be that they want to prevent GPS spoofing
There’s no reason a company couldn’t release the info legally unless it was under something like AML (anti money laundering) laws and you were flagged as a criminal. They legally can’t disclose why in that case.
Using a different OS isn’t reason enough, if they were telling the truth about the legal restrictions.
Do the web apps not still work? I’ve booked Uber eats from a computer in the past, I’m imaging the phone browser version might still function. I don’t have lyft in my country to know tho.
I’ll have to try next time and report back. Honestly don’t use ride sharing too often. I prefer public transport.
FYI, grapheneOS devs added a list of apps to their wiki:
https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos
man, and i was gonna switch to graphene this christmas. if every app can just ban my OS, i might have to rethink this. i would use the website but they restrict so many things to apps now…
Well, switching to GrapheneOS shows that you don’t care what those companies do, and that you’re willing to fight. It means those companies lose one more customer. The more people that use GrapheneOS, the more companies will be forced to support it.
Honestly i didn’t even think of that. i’ll still switch then!
Nice choice. You not switching is exactly what these companies wanted.
I was about to switch bank because for a few days my current one (inadvertently) blocked it on grapheneOS. We sent them a few emails and they fixed in less than a week.
I use a small local credit union that doesn’t appear on their supported list. It’s literally the only thing holding me back, I’m tempted to say fuck it anyway. But I wonder if it might work anyway…
If nothing else can you use the browser?
I’ve used Hermit for years to present websites like an app, and am using Native Alpha on my new phone.
Yeah you’re probably right. I’ve gotta get a new phone before I can really attempt it, but I’ll at least try!
- Order a Pixel
- Flash GrapheneOS
- If it works, congratulations! If not, switch banks or revert to stock and return the phone.
What’s the app name? I could install it and see what happens
TBF, this is the first time I’ve encountered an app not working - and it was before this. It’s just because of Google push towards monopoly via their Play Integrity API that’s ruining this.
play “integrity” should be considered malware, any program that deliberately does something the user doesn’t want it to should.
Use a browser like Native Alpha or Hermit, which present a website like an app.
And if you use Bitwarden/Vaultwarden for your passwords, it can be pretty seamless.
