LineageOS 22 (opens in new tab)

[1] https://grapheneos.org/articles/attestation-compatibility-gu...

The second reason though I can think a bank would want attestation is as an anti-piracy measure. With a website, you have HTTPS verifying the identity of the domain. With an app, a pirated app or a 3rd party app from any source could hypothetically intercept user's banking information, their scanned checks, or even attempt to cash their scanned checks itself. It's not about making sure the device is secure, as it is killing attempts at 3rd party, modified, or malicious clients. The last thing I want, or the bank wants, is some grandmother downloading the "Wells Fargo Bank Plus with Giant Legible Accessible Text" app she saw in an ad as an APK, installing it, and being a victim of silent fraud for years.

The third reason a bank might want it, is also just simple stupid litigant America. If such a scheme similar to the above were to occur, the bank would likely be sued by victims arguing that the above circumstance was preventable. The victims would also be correct, it was preventable. The bank is then in the unenviable position of telling the jury that supporting the rights of 0.1% of phone modders was more important than victimized grandmothers.

Or, as a bank lawyer would say, just turn on attestation, it costs basically nothing, and then none of the above could happen. Better safe than sorry. After all, is the grandmother not also a customer, and preventing malicious clients in her best interest? Sure, some customers will be inconvenienced, but this is America, where anyone depositing more than $10K is subject to an interrogation.

Back in 2009 during the Cyanogenmod days, Google issued a C&D to the developers to keep them from distributing Google Apps alongside the main ROM. IMO it was less about the app distribution and more to force Cyanogemod to come to the table and work with Google to develop ground rules on how 3rd party ROMs would interact with Google more broadly. Cyanogemod (now LineageOS) basically agreed not to step on Google's toes. At the time it was not to distribute Google's Apps inside of the ROM. Now it's to not bypass OS level protections like Play Integrity (formerly Safety Net)

Their stance now can be found here: https://lineageos.org/PlayIntegrity/ . Note the part that says:

> Any action taken to bypass Play Integrity risks a backlash against all custom OSes, and could cause Google to block them entirely from the Play Store.

So long as the main players follow this advice, Google tends to also ignore smaller players that _are_ working around this via Magisk or other means. It's also possible that this simply becomes non-viable after some time.

It's also worth noting, Google has ways to allow third parties to certify their devices on https://www.google.com/android/uncertified/ . This doesn't grant fully Safety Net, but it's definitely another way Google is working with custom ROMs to ensure you have access to the Play Store

Imagine, if inside your phone, there's your main processor named Bob. Bob runs all of your apps, Bob is occasionally stupid and gets hacked, but he means well.

Also inside your phone, is another processor named Alice. Bob can't see her even if he can send messages to her, but Alice can see Bob through a one-way mirror. Alice is also located inside of a concrete steel bunker with no entry, no exit, and UV sterilization of all single-page letters coming in or out after examination by an officer. Alice has a special ID card given to her by Google, which was only given her after Google was satisfied in the security of the bunker.

Google sends super high-secure work for Bob to do. Bob isn't the most trustworthy of fellows; so Google also sends a message asking Alice to report back on whether Bob is doing what he's supposed to. Alice sends her report back to Google with her signature on it. Google trusts that signature, because it previously inspected Alice and the security of her bunker, and knows that as long as Alice is safe and Bob can't harm her, Bob is doing the work intended.

Now, you might say, why not just make sure Bob is stronger? Well, Google tried that, but with people wanting to sideload apps, the needs of developers, security bugs, that's all extremely difficult. Having Alice do nothing but verify and sign in a super secure bunker while accepting various requests for oversight - that's easy, auditable, much easier to secure, and rarely needs change.

Where it gets even stronger is what I would call, for lack of a better word, "progressive lockdown." For example, when Bob is just starting up, Alice can check that he started up from an approved OS (Secure Boot). Once that's happened, the Secure OS might hand Alice a piece of code for the OS that is never allowed to change in the future while the device is booted (Secure Monitor / TEE). Alice doesn't have to run the code herself; just panic if that code ever changes. By doing so, the OS now has super-high-security functions for itself, that can always be changed out through any update, without Alice needing any updates, changes, or expanded attack surface herself. By that point, Alice can be OS-agnostic so it doesn't matter whether it's Bob or Kevin, and could even be a permanent hardware feature that never needs updates... oops, you've just invented TPM / Verified Boot / Titan M.

I'm curious though, what are the more nefarious uses you're concerned about?

Buying a separate device and carrying it all the time just for banking is a big ask for most people, even for geeks who hack their Android phones.

It's definitely not a non issue for me.

The latter has sane sandboxing, proper IPC, an app lifecycle that makes sense for embedded devices (an app in the background should only ever take CPU time if it has an explicit service with permission for that) etc.

On the other hand, LineageOS runs a lot of devices at the very (lower) edge of compatibility, which means that (with Google pushing large changes quarterly instead of yearly) the build roster has to be reevaluated quarterly instead of yearly as well. This was not anticipated properly for the Android 14 (LineageOS 21) cycle, which resulted in 19 devices not being able to be built on a previously supported major version (and therefore dropping from the roster completely).

In addition, the components that have been causing rebase conflicts each year now have the opportunity to cause rebase conflicts multiple times a year.

GrapheneOS installs easily via your desktop web browser with the Pixel device connected via USB.

The practice makes ewaste of otherwise perfectly usable devices, and should be illegal.

This is a list of support devices

https://wiki.lineageos.org/devices/

I installed LineageOS on a Motorola Edge a bit back.

One problem is it takes a bit of time for a device to get officially supported by LineageOS. By the time it is, stores are often selling the next generation of devices.

That was not the case when I bought an Edge and put LineageOS on it in 2021.

But this is really a brand to avoid at all cost anyway. Also these smartphones come super bloated out of the box with apps phoning home constantly, and super unreliables. 2 members of my houshold owned one and on both of them the screen started not accepting touch input randomly. These was on 2 different models.

Pixels are the reference. Whatever you buy, verify VoLTE.

I got a OnePlus and a Pixel. Before that it was a ZTE, but they aren't unlock-friendly these days.

I am not a LineageOS user, but I own a 5 year old Xiaomi phone. The latest Android version for that phone from Xiaomi is stuck at Android 9. It now runs Android 13 on /e/OS, a fork of LineageOS, and I have a good experience with it.

But their sandboxed GApps service is truly how a mobile OS should work!

Anyway ... I'd totally encourage everybody to donate to opensource projects and/or its maintainers. Whatever the effect may be, but I think that's just simply appropriate.

Amusingly, my health insurance app (Tk) does not.

My original motivation for deploying this particular phone was for Cisco Duo, which also runs on it.

It's completely absurd, but it's how it works today.

Having said that, most bank apps still work on custom android images. Mine works on grapheneOS.

Having the second device just opens up more chances that you have something that works.