|
Top-level
 How you can help solve it: 1) Open a support request explaining they've incorrectly banned a secure operating system with a link to https://grapheneos.org/articles/attestation-compatibility-guide with how to fix it. 20 comments
United States v. Google LLC (2020) recently found that Google's Android partner system and therefore the Play Integrity API based on it is illegal. We're in active contact with the EU Commission about the Play Integrity API and are hopeful they're going to do something about it. @GrapheneOS Hope the EU listens and intervenes, the problem also affects European digital identity apps that require Play Integrity API. @pippopippo13 @GrapheneOS ancora a me l'app funziona, forse perchรฉ sono loggato @pietro395 @pippopippo13 It's meant to be checked on login and specific actions such as sending a transaction according to Google's intended usage of it. A lot of apps only check it at login and never check again if you never log out. @GrapheneOS Finally someone looking into Google's malicious Play Integrity API. I am unable to use many financial apps on GrapheneOS despite it being up-to-date and secure whereas I can use those Apps on a cheap insecure Android 10 phone which does not get updates. I don't think financial app developers have any critical thinking when it comes to security, especially in my country. Here are the Play Store pages where you can leave feedback: https://play.google.com/store/apps/details?id=com.revolut.revolut Ask them to use the Android key attestation API to perform attestation with the ability to permit GrapheneOS. We linked our guide on using it above and it works well.  @GrapheneOS I found this reply on the reviews: > [...] To protect our users and ensure compliance, we implement measures to limit access from devices with custom firmware. This is primarily to safeguard accounts against potential vulnerabilities that can arise from altered operating systems. That's very generic, and (especially when the review in question mentioned the security benefits of GrapheneOS) very telling. Revolut is misleading users making support requests by falsely claiming there's a compatibility issue with GrapheneOS. It's not true. They're banning using a non-Google-approved OS. If it was a compatibility issue with this widely used app, we'd have worked around it on our end. In some of their responses, they claim they check for a Google-certified OS for security reasons. Can't be true, because they're permitting an OS which hasn't received security patches for the past 8 years. They're disallowing a much more secure OS than anything Google approved. Banning a more secure operating system as part of implementing a fake security feature shows serious anti-security culture at RevolutApp. A company which deliberately permits a device with no patches for 8 years but not a hardened OS does not understand or care about security. Can see it's clearly because they're banning GrapheneOS because they show an error at login about you using an OS they don't support. It is not a compatibility issue. Meanwhile, they support every insecure OEM fork licensing Google apps no matter how long it hasn't been patched. @GrapheneOS @ronwithmusic The response is incorrect. First of all, microG is not an OS and has nothing to do with this. Their app fully works on GrapheneOS and has no compatibility issues with it. The issue is that they're going out of the way to use the anti-competitive Play Integrity API to ban using anything other than an OS partnered with Google. Keep replying and keep filing issues. Users need to put a lot of pressure on them and burn lots of their resources. Can contact management on LinkedIn too. |
Gregory's Server
We have a thread with more details on the highly anti-competitive Play Integrity API masquerading as a security feature here:
https://grapheneos.social/@GrapheneOS/112878067304840664
Play Integrity API forbids a far more secure OS than anything they allow but yet it permits devices with no patches for 8 years.