PrivSec

I like much of the software recommended, but this seems AI generated and the lack of threat modeling makes this site ineffective and it won't really help people. >Advanced users, especially on GrapheneOS, with a high threat model. Android only. High threat model is not a threat model. >https://ublockorigin.com/ That's not the correct link and that website promotes uBlockDNS.com which is sketchy imo solely based on the fact that they're impersonating uBlock Origin. I recommend PrivacyGuides[1] and PrivSec.dev[2], they're human-written and actionable. https://www.privacyguides.org/en/basics/why-privacy-matters https://privsec.dev/posts

There's a compatibility list at https://privsec.dev/posts/android/banking-applications-compatibility-w… I think the challenges here exist but the reality is overblown to be honest, the vast majority of banking apps (everything that isn't struck through in that list) work just fine. Fully agree the concern is discouraging adoption though. I would love to see more of a solution here, it seems like purely anti-competitive behaviour by Android that will block competitors emerging.

My understanding from looking into this two years ago is that it's hit or miss for banks (depending on if they opt into device attestation stuff), no for NFC / Google Wallet, and yes for Uber / Lyft. Apparently the common workaround for the Google Wallet stuff is to pair a GrapheneOS phone with a stock Android smartwatch. Edit: Here's some additional information on banking apps: https://privsec.dev/posts/android/banking-applications-compatibility-w… Apparently the common recommendation these days is to use Curve Pay as a virtual card provider on GrapheneOS, which can then route to arbitrary underlying cards. And evidently Google Wallet does work for things that aren't payment cards (airline tickets, transit passes, etc.) on GrapheneOS.

Absolutely. You should check out the list [1] to see what banking apps are verified working with GrapheneOS. It's worth noting if your banking app isn't on this list it does not mean it will not work. [1]: https://privsec.dev/posts/android/banking-applications-compatibility-w…

> The same way, as you can trust binaries from F-Droid more, than from Google Play. Actually, no. I'm forgetting the exact details - but F-Droid (if I recall correctly) re-signs all packages with its own key, removing the developer's signing key. There's some infrastructure reason for it. Google Play keeps that key. This is also why GrapheneOS offers sandboxed Google Play and recommends using that over F-Droid. https://privsec.dev/posts/android/f-droid-security-issues/

F-droid should be avoided when you can get an apk release directly from the developer or the Google Play Store. Obtanium is great for managing this. https://github.com/ImranR98/Obtainium https://privsec.dev/posts/android/f-droid-security-issues/

Thank you for these comments! Great to hear that the compatibility situation is pretty good. Have you considered submitting the apps to https://privsec.dev/posts/android/banking-applications-compatibility-w… It would encourage people not to give up on using an alternate OS :)

Yes, I find it much easier to set up and use than any other Android phone. There’s less bloatware, and battery life is noticeably better. Two tips for beginners: Google Play Store and Google Play Services can be installed from the App Store. They aren’t included by default because GrapheneOS works fine without them. If a trusted app has trouble running, try enabling Exploit protection compatibility mode on the app’s Info screen (long-press the app icon → Info → Exploit protection). Check whether your bank is supported: https://privsec.dev/posts/android/banking-applications-compatibility-w… If it isn’t, it likely depends on the Play Integrity API, which means it requires customers to stay under constant surveillance by the world’s largest advertising company, with no real security justification (see https://grapheneos.org/articles/attestation-compatibility-guide). In that case, you should switch to a more trustworthy bank.

Time estimate depends heavily on the apps you use (data migration in them) and maybe some features that don't easily work out-of-the-box in GOS like Google's find my device, where you'd ideally migrate to use foss alternatives like FMD[1]. For the easiest setup by far just install the sandboxed Google Play Store and get your apps from there. In general the more additional security features you enable, the more issues you may face, so I'd recommend leaving everything to GOS default, like leaving Sensors permission ON by default. There are a few gotchas that may not be mentioned in GOS official documentation or elsewhere such as BT tracker devices not being supported for the most part, requiring workarounds. There are also few apps that don't currently support GOS [2][3], so be sure to check them out beforehand. 1: https://gitlab.com/fmd-foss/fmd-android 2: https://grapheneos.org/articles/attestation-compatibility-guide#apps-b… 3: https://privsec.dev/posts/android/banking-applications-compatibility-w…

As much as I'd love to daily drive an OS like GrapheneOS, the risk of running into apps that use Google Integrity API thereby making it impossible to run those apps on Graphene is too much of an inconvenience. I took a look at this curated list of bank apps[1] supported on Graphene OS and I'm glad that a large majority of them work on Graphene. However, just my luck that one of the banks I use on this list isn't supported. In my country, the state is enforcing a lot of essential workflows to be digital-first (and in extreme cases digital-exclusive) and I dread to think needing these services at a crticial moment and the choice of my OS making it impossible for me. This is more of a commentary on my government's choices but it's a reality for me. In any case, I don't think it's practical to go cold turkey and switch to a privacy focused phone without testing waters first to see which of your of workflows break and then reason about the tradeoffs/workarounds. I do admire folks who use GrapheneOS as a daily driver, I'd like to chat them up if I find them in the wild. https://privsec.dev/posts/android/banking-applications-compatibility-w…

> my main worry is about banking and NFC This may be useful: https://privsec.dev/posts/android/banking-applications-compatibility-w… > I also worry about the future of Graphene with AOSP going more closed/private I don't think it's AOSP going more closed, but rather the evolution of the Pixels line. GrapheneOS wants the ability to unlock the bootloader, install their own key and relock the bootloader. Google could technically stop supporting that for the Pixels (just like many (most?) manufacturers do), but they haven't said anything about it. GrapheneOS has mentioned talks with a major manufacturer. I wonder if it will be a Graphene phone (which sounds very tricky) or if it could be something like Huawei or Samsung offering to unlock/relock the bootloader and committing to providing the features necessary for GrapheneOS. The latter would be amazing. > OSMAnd was the one I tried and it bordered on unusable. I love it. But if that's your feeling, definitely try CoMaps: in terms of UX it's on the other end of the spectrum :-).

They have this completely backwards. GrapheneOS provides much better privacy than CalyxOS including features like Contact Scopes, Storage Scopes, per-app Sensors toggle, Network toggle instead of the leaky LineageOS approach, per-connection MAC randomization, fixes for many data leaks and much more. GrapheneOS provides much broader app compatibility than CalyxOS via sandboxed Google Play. Apps forbidding using an alternate OS via the Play Integrity API is an issue for any alternate operating system and it's known that spoofing the device integrity check for Google certification is not a sustainable approach that will keep working. It already doesn't work consistently. CalyxOS is not a hardened OS. It greatly reduces security vs. AOSP via added attack surface, rolled back security and slow patches. Compatibility with Android apps on GrapheneOS is also much different. GrapheneOS provides our sandboxed Google Play compatibility layer: https://grapheneos.org/usage#sandboxed-google-play Can run the vast majority of Play Store apps on GrapheneOS, but not CalyxOS with the problematic microG approach. https://eylenburg.github.io/android_comparison.htm is a third party comparison between different alternate mobile operating systems. It could include many more privacy/security features but it's a good starting point. https://privsec.dev/posts/android/choosing-your-android-based-operatin… is an article with more long form comparisons between OSes.

90% of banking apps work on GrapheneOS. https://privsec.dev/posts/android/banking-applications-compatibility-w…

Graphene passes basic integrity, so most of them work. There is a list here: https://privsec.dev/posts/android/banking-applications-compatibility-w…

You can install google's camera app if you want, and it works exactly the same. I also use a garmin and haven't bothered with banking apps (all banks have a website and I avoid closed source software when I can), but it looks like quite a few are supported: https://privsec.dev/posts/android/banking-applications-compatibility-w…

My experience is the same as yours, and I run a huge number of apps for work purposes. A few have required disabling exploit protection but otherwise work fine. With only one brief exception, all of my financial institution's apps have worked fine, too, including some banks I see drive-by complaints about on here. Anyone curious should refer to the tracker: https://privsec.dev/posts/android/banking-applications-compatibility-w…

Graphene OS user here. Almost all of the apps I tried work fine. All the banking apps I use work. Have you tried reaching out to the app developer or the service and explaining what Graphene OS is and asking them to support it? I was able to persuade one app to do it. [1] https://privsec.dev/posts/android/banking-applications-compatibility-w…

1) No one is saying that. As another commenter mentioned, Android is open source. 2) The point still stands, desktop operating systems like Windows and desktop Linux distributions are much less secure than Android or iOS. Read https://privsec.dev/posts/linux/linux-insecurities/

The vast majority work, check this list for details: https://privsec.dev/posts/android/banking-applications-compatibility-w…

There is a list of compatible banking apps: https://privsec.dev/posts/android/banking-applications-compatibility-w…

The person you replied to is right, the "security" of Linux might as well be nonexistent compared to macOS and especially iOS/Android. Even the developers of Secureblue (https://secureblue.dev/) state that despite their hardening and mitigations Linux still lags far behind macOS (and possibly Windows) security-wise. The only Linux derivative that has proper security is Android, and even better GrapheneOS. https://privsec.dev/posts/linux/linux-insecurities/ https://madaidans-insecurities.github.io/linux.html I also commented here on Linux phones, the same can apply to Linux as a desktop OS: https://news.ycombinator.com/item?id=46997397 Also on top of that Linux/Windows laptops also lack the hardware-backed security that Macs and to an extent some Chromebooks have.

Useful reference for banking app compatibility in grapheneOS https://privsec.dev/posts/android/banking-applications-compatibility-w…

Also, it works in practice. Some banks have fixed their apps after GrapheneOS mentioned that the app was broken. In some of the issues/reports linked at https://privsec.dev/posts/android/banking-applications-compatibility-w… there are even bank app developers joining in on the discussion (e.g. NL -> Triodos).

I agree with your post however further info on one point: > but all of them use mobile apps for banking which effectively locks them in Many banking apps work fine with GOS. But given banking and money is such an important part of our lives it is easy to see why people might be hesitant. It doesn't guarantee future compatibility.... but linked below is a GOS [banking app] status list, crowdsourced info by country. https://privsec.dev/posts/android/banking-applications-compatibility-w…

F-Droid is not a safer app repository: https://privsec.dev/posts/android/f-droid-security-issues/ And most Android banking malware is distributed through unsafe sideload installs (as opposed to much safer Gatekeeper-style installs, which is what is coming) and are fed to victims through complex attacks involving obtaining a victim's personal information and calling them while credibly pretending to be a local authority or a bank representative. You can read about this wherever you get news about cyber crime. This is a scourge in South East Asia and Google can do some good here. The only cost is whining from non-technical people. Everyone else will go pay $25 or whatever and sign their app.

You've got a lot of people contesting the "often" part but I'll also add that there's a project tracking banking apps that do work: https://privsec.dev/posts/android/banking-applications-compatibility-w… My tiny local credit union app isn't on there, but it worked fine. I miss wallet a bit and it's a shame that there are important apps which still refuse to act reasonably, but I don't think it's really that bad.

"Terrible" is incorrect. Yes quite a few don't work but many many do . See: https://privsec.dev/posts/android/banking-applications-compatibility-w…

NatWest and Monzo work fine on my Pixel 9a running GrapheneOS. Community maintained list of supported banking apps here: https://privsec.dev/posts/android/banking-applications-compatibility-w… Google Wallet is not supported at all.

Based on this resource, it seems there's very extensive testing of banking apps on grapheneOS, and the large majority works. https://privsec.dev/posts/android/banking-applications-compatibility-w…

I use 5 different banking apps and 3 other financial/investment apps and they all work fine, you should check compatibility with yours [1]. And to be precise, contactless payments work but not through Google Pay - I've heard that Curve is a viable alternative, and some banks might have their own systems that aren't based on Google Pay (though most seem to be). [1] https://privsec.dev/posts/android/banking-applications-compatibility-w…