GrapheneOS attestation compatibility guide
grapheneos.org
Guide on using remote attestation in a way that's compatible with GrapheneOS.

cross-posted from: https://slrpnk.net/post/15995282

Real unfortunate news for GrapheneOS users as Revolut has decided to ban the use of ‘non-google’ approved OSes. This is currently being posted about and updated by GrahpeneOS over at Bluesky for those who want to follow it more closely.

  • orange@communick.news
    0·
    13 days ago

    For GrapheneOS, it’s primarily that it’s re-lockable. That’s why other unlockable phones aren’t supported.

    The GrapheneOS install process sets new OS signing keys so you can lock the phone again and get full verified boot. However, most manufacturers haven’t implemented this feature.

    • fuzzzerd@programming.devEnglish
      0·
      13 days ago

      What do you get, app/feature wise for verified boot vs. Play integrity app? Does it increase the amount of apps that work on it?

      • orange@communick.news
        0·
        10 days ago

        No, Play Integrity intentionally checks if it’s a Google-approved key. Android itself has an API to check verified boot and gives info on the signing key - most devs just want to know verified boot is working.

        I feel Play Integrity has a short life ahead of if competition authorities realise how exactly it works. “Anti-competitive” is the first thing policy-minded folks think when I explain the API to them.