undefined | Better HN

0 pointsstrcat8mo ago0 comments

You can use most banking apps on GrapheneOS but a subset block using any alternate OS. GrapheneOS supports hardware attestation and some banking apps explicitly permit GrapheneOS via hardware attestation such as Swissquote which recently added it. Banking app compatibility on GrapheneOS is better than any other alternate OS due to some apps choosing to special case allowing it.

Google will not using their service for tap-to-pay.

0 comments

tarruda8mo ago

My only concern is this: Android phones I tried to root so far will be "tainted" if I unlock the bootloader and can never go back to a state where it passes all checks.

I'm okay with losing access to Google wallet while using Graphene os (I can just use plain old credit cards), but I would like to have the option to revert it in the future.

scrlk8mo ago

Pixel devices don't have anything like the Samsung Knox eFuse, which blows after running a third-party bootloader.

j4hdufd88mo ago

Where are you getting this information? For what it is worth, Wikipedia mentions the Pixel 6 on the eFuse page https://en.wikipedia.org/wiki/EFuse

Myself I have not reverse engineered the Titan M2 security chip, but surely it uses eFuse or OTP memory for anti rollback protection mechanisms and such.

These are really basic hardware security primitives. I'm curious why you're under the impression Pixels wouldn't use eFuse.

Andromxda8mo ago

> For what it is worth, Wikipedia mentions the Pixel 6 on the eFuse page https://en.wikipedia.org/wiki/EFuse

The Pixel 6 is only mentioned in regards to anti-rollback protection. This has nothing to do with unlocking and later relocking the bootloader. Pixels have always supported relocking the bootloader with a custom root of trust, i.e. custom AVB signing keys used by a custom, user-installed operating system.

https://source.android.com/docs/security/features/verifiedbo...

1 more reply

scrlk8mo ago

You mentioned devices being irreversibly "tainted" after unlocking the bootloader.

On Samsung devices, blowing the Knox eFuse permanently disables features tied to Knox (e.g. Samsung Pay, Secure Folder). ("can never go back to a state where it passes all checks")

Pixels do not have an equivalent eFuse that permanently disables features (discounting the ability to flash previous versions of Android). Restoring stock firmware and relocking the bootloader will give you a normal Pixel.

1 more reply

strcatOP8mo ago

> My only concern is this: Android phones I tried to root so far will be "tainted" if I unlock the bootloader and can never go back to a state where it passes all checks.

There's no such thing for Pixels, and it also doesn't void the manufacturer warranty.

j / k navigate · click thread line to collapse

0 comments

tarruda8mo ago

My only concern is this: Android phones I tried to root so far will be "tainted" if I unlock the bootloader and can never go back to a state where it passes all checks.

I'm okay with losing access to Google wallet while using Graphene os (I can just use plain old credit cards), but I would like to have the option to revert it in the future.

scrlk8mo ago

Pixel devices don't have anything like the Samsung Knox eFuse, which blows after running a third-party bootloader.

j4hdufd88mo ago

Where are you getting this information? For what it is worth, Wikipedia mentions the Pixel 6 on the eFuse page https://en.wikipedia.org/wiki/EFuse

Myself I have not reverse engineered the Titan M2 security chip, but surely it uses eFuse or OTP memory for anti rollback protection mechanisms and such.

These are really basic hardware security primitives. I'm curious why you're under the impression Pixels wouldn't use eFuse.

Andromxda8mo ago

> For what it is worth, Wikipedia mentions the Pixel 6 on the eFuse page https://en.wikipedia.org/wiki/EFuse

https://source.android.com/docs/security/features/verifiedbo...

1 more reply

scrlk8mo ago

You mentioned devices being irreversibly "tainted" after unlocking the bootloader.

On Samsung devices, blowing the Knox eFuse permanently disables features tied to Knox (e.g. Samsung Pay, Secure Folder). ("can never go back to a state where it passes all checks")

1 more reply

strcatOP8mo ago

> My only concern is this: Android phones I tried to root so far will be "tainted" if I unlock the bootloader and can never go back to a state where it passes all checks.

There's no such thing for Pixels, and it also doesn't void the manufacturer warranty.

j / k navigate · click thread line to collapse