Post #4177890
2026-07-28 21:40 UTC
Replies (2)
-
@tranquil_cassowary@infosec.exchange 2026-07-29 00:33
@xoagray@tiggi.es @TheMNWolf@furry.engineer Some extra context to this: Almost all apps work and most banking apps also work. Its just a small minority that doesn't, which is more common in the banking category. The reason for this is almost solely the Play Integrity API. Other compatibility issues, that GrapheneOS can fix by changes on their side, get fixed swiftly. Play Integrity is an API made by Google which they market towards app developers as benefiting the security of their app. However the API doesn't use objective criteria related to security. The API blocks GrapheneOS because it isn't certified by Google. A certification they can only obtain by licensing and bundling Google Mobile Services, which they don't do and don't want to do. GrapheneOS however is a very secure OS that keeps up with updates to Android. While blocking this secure OS, the API allows OSes which are severely behind on security updates, running on devices which are end of life, just because they are certified. So we can conclude that it's false communication from Google to devs that this API is focused on security. The API is deemed anti-competitive by GrapheneOS and pressure is applied on app developers to either ditch Play Integrity or explicitly allow GrapheneOS via a different API. Some developers have done that, which is nice. Ideally, regulators would taken action in the context of anti-trust.
-
@springonion@infosec.exchange 2026-07-29 00:34
@xoagray@tiggi.es @TheMNWolf@furry.engineer That's not quite right but you're not far off. The optional Google Play services you find on GrapheneOS are official, if they merely act as a dependency to, say, a banking app it will work fine. It only becomes problematic when an app opts in to play integrity. In essence higher play integrity verdicts require your operating system to receive Google's blessing. GrapheneOS isn't and can not be blessed no matter how much more private and secure it is over stock Android and its official flavours. So apps enforcing this system that's designed to upkeep Google's monopoly leave GrapheneOS outside while any ordinary OEM that plays by Google's rules are happily let in.