Gregory's ServerUnfortunately, Revolut has banned GrapheneOS users from logging into the app because of an incorrectly implemented device integrity check based on the anti-competitive Play Integrity API. Our users need to put pressure on apps like this to get them to whitelist GrapheneOS.
 35 comments
We have a thread with more details on the highly anti-competitive Play Integrity API masquerading as a security feature here: https://grapheneos.social/@GrapheneOS/112878067304840664 Play Integrity API forbids a far more secure OS than anything they allow but yet it permits devices with no patches for 8 years. United States v. Google LLC (2020) recently found that Google's Android partner system and therefore the Play Integrity API based on it is illegal. We're in active contact with the EU Commission about the Play Integrity API and are hopeful they're going to do something about it. @GrapheneOS Hope the EU listens and intervenes, the problem also affects European digital identity apps that require Play Integrity API. @pippopippo13 @GrapheneOS ancora a me l'app funziona, forse perchรฉ sono loggato @pietro395 @pippopippo13 It's meant to be checked on login and specific actions such as sending a transaction according to Google's intended usage of it. A lot of apps only check it at login and never check again if you never log out. @GrapheneOS Finally someone looking into Google's malicious Play Integrity API. I am unable to use many financial apps on GrapheneOS despite it being up-to-date and secure whereas I can use those Apps on a cheap insecure Android 10 phone which does not get updates. I don't think financial app developers have any critical thinking when it comes to security, especially in my country. Here are the Play Store pages where you can leave feedback: https://play.google.com/store/apps/details?id=com.revolut.revolut Ask them to use the Android key attestation API to perform attestation with the ability to permit GrapheneOS. We linked our guide on using it above and it works well.  @GrapheneOS I found this reply on the reviews: > [...] To protect our users and ensure compliance, we implement measures to limit access from devices with custom firmware. This is primarily to safeguard accounts against potential vulnerabilities that can arise from altered operating systems. That's very generic, and (especially when the review in question mentioned the security benefits of GrapheneOS) very telling. Revolut is misleading users making support requests by falsely claiming there's a compatibility issue with GrapheneOS. It's not true. They're banning using a non-Google-approved OS. If it was a compatibility issue with this widely used app, we'd have worked around it on our end. In some of their responses, they claim they check for a Google-certified OS for security reasons. Can't be true, because they're permitting an OS which hasn't received security patches for the past 8 years. They're disallowing a much more secure OS than anything Google approved. Banning a more secure operating system as part of implementing a fake security feature shows serious anti-security culture at RevolutApp. A company which deliberately permits a device with no patches for 8 years but not a hardened OS does not understand or care about security. Can see it's clearly because they're banning GrapheneOS because they show an error at login about you using an OS they don't support. It is not a compatibility issue. Meanwhile, they support every insecure OEM fork licensing Google apps no matter how long it hasn't been patched. @GrapheneOS @ronwithmusic The response is incorrect. First of all, microG is not an OS and has nothing to do with this. Their app fully works on GrapheneOS and has no compatibility issues with it. The issue is that they're going out of the way to use the anti-competitive Play Integrity API to ban using anything other than an OS partnered with Google. Keep replying and keep filing issues. Users need to put a lot of pressure on them and burn lots of their resources. Can contact management on LinkedIn too. Change the bank and tell them ๐ because it's pretty not a bad luck, they are targeting privacy users
 @GrapheneOS could you please stop using the term "whitelist" as it has racist connotations  @iviyohane Google's behavior has already been found to be illegal and they're unlikely to start walling off their own services in a completely indefensible way. They're already going to be facing serious consequences for what they're doing. It's unfortunate they're doubling down on pretending the Play Integrity API has anything to do with security and convincing more and more apps to adopt it though. They think they'll get away with it because they claim it's about security but it's clearly not.  |
How you can help solve it:
1) Open a support request explaining they've incorrectly banned a secure operating system with a link to https://grapheneos.org/articles/attestation-compatibility-guide with how to fix it.
2) Contact their management on LinkedIn and other platforms with the same thing.
3) Play Store review.