Pay securely with an Android smartphone, completely without Google services: This is the plan being developed by the newly founded industry consortium led by the German Volla Systeme GmbH. It is an open-source alternative to Google Play Integrity. This proprietary interface decides on Android smartphones with Google Play services whether banking, government, or wallet apps are allowed to run on a smartphone.
Furthermore, a peer review process is planned, through which the consortium members will mutually check and certify their operating systems and smartphone or tablet models. “This is intended to create transparency and replace trust with traceability.”
Still doesn’t sound very open.
I should be able to tell my bank to only trust devices running an OS signed by the grapheneos key, and more importantly I should be able to tell them to trust an OS signed by my key.
Edit: I don’t mean to shit on this too hard. It might be the best next step.
It is kinda insane though that we’ve had public/private keys since the internet started walking and somehow we end up with all these over-complicated or pointless ways to use them.
I should be able to tell my bank to only trust devices running an OS signed by the grapheneos key, and more importantly I should be able to tell them to trust an OS signed by my key.
How do you know that your OS installation doesn’t include malware? Like there have been many cases in the last few years where
npmmodules were found to contain malware. Who says that’s not also the case in some modules that are a part of your OS?And more importantly, who is legally liable if malware actually does cause harm? E.g. malware acts on your behalf and sends your money to some criminal organization. Not only did you lose money, but now you’re a suspect of supporting a criminal organization!
Of course that issue might be alleviated if you simply don’t have any money to send anywhere in the first place. That might be a viable alternative, but it only works for some people, i’d say. Or you could also set a daily transaction limit of say $100 that you can use to buy groceries; to limit your losses that way. The limit ofc cannot be changed from your phone alone, you need to go to a bank physically to change it or sth. Otherwise malware could again change it on your behalf.
And who guarantees that your PC doesn’t have malware?
Seriously, people will gobble up all the shit served to them without a question asked or giving it a second thought.
And who guarantees that your PC doesn’t have malware?
Microsoft is legally responsible if the software they provide is found to actually contain malware.
You don’t understand what you’re talking about. You’ve made that very clear twice now.
I see this topic come up often in conversations about degoogled Android and it makes me wonder what if anything I’m missing out on by just using cash/card for payments, cause not once have I been at checkout and thought to myself “man, I wish I could do this with my phone instead” but people talk about this like it’s almost a dealbreaker that makes it hard for them to seriously consider switching to Graphene or Lineage or whatever.
I agree, it’s a nice-to-have but it’s far from necessary. I like having the option as a backup in case I forget my wallet, but I’ll live without it
I agree, with the caveat that it’s very nice to be able to pay with my phone/ watch if/when forget my wallet, rather than having to go back home to get it.
It’s the hardware, and it feels like mobile in particular is intentionally designed to not be modular. I suspect that is by design to keep it under control of the big companies.
I don’t use the phone that often as a debit /credit bank card but I use it for payments (bills invoices etc.), paying on line, transferring money to people and accounts, and just managing accounts. The phone app is very useful for those functions - especially if the alternative is going into a bank and queuing.
A phone OS that will not work with banking apps is not really a contemporary solution. iOS or Android are the only reliable options at the moment in the US/Europe - Iiuc Open Source Android has to sandbox Google Play for banking apps to work so that’s not viable long-term solution, as Google will only make that more difficult in the future.
Given the issues with the judges at ICC and US payment systems, building an alternative to Google and Apple is a high priority
The phone app is very useful for those functions - especially if the alternative is going into a bank and queuing.
the bank’s web portal should also work for this.
if it refuses to open on your phone, try firefox and enable desktop mode for that tab
Iiuc Open Source Android has to sandbox Google Play for banking apps to work
that’s not necessary but also not enough for it. the bank apps specifically check if you run a google/apple approved, unmodified operating system.
today it is not possible to pay with an open source operating system. somewhat of an exception is grapheneos, but even if you just build it from source for yourself, the bank’s app will refuse operation.
and on top of that, google services are required too if you want to pay with your phone in shops.
so this is not something open source os maintainers can solve. it is a result of google engaging in illegal practices which are not prosecuted.
building an alternative to Google and Apple is a high priority
Technically… afaik most banks in the EU also support current non-android huawei phones, which have their own implementation of the play integrity service to lock you into the factory os. but huaweis are not better, probably worse.
Honestly if there was an alternate and functional phone/OS/app store that early adopters who are a little technical can embrace, it would be the #1 platform in under 5 years. People in the know are chomping at the bit to get away from these big monopolzed platforms, and once it gains steam and polish, people will flock to it.
There are already alternate app stores, and alternate OS and phones that are functional and niche. The real issue is that the Android people knows is not open source, AOSP is the thing open sourced, but thats far from what we use on a daily basis as Android, and Google makes sure every time it can to put hurdles between functionality and open source, some of those hurdles can and are being worked on, some others are out of reach for the open source community
I’ve never developed on Android, but would it be hard to port most apps to AOSP at this point if the developer wanted to?
It’d be effortless.
Yeah so I don’t see what the issue is. If they gave me stock android from 8 years ago I would still be happy to use it, and most basic users probably wouldn’t even know the difference. There are very few features released in the past few years that I couldn’t live without. Probably the only notable one I can think of is notification history. Other than that it has been all downhill, like removing the ability to easily record calls, which iphone can do no problem. As it is now I have to use a differnt phoen a a bunch of hacks to get it to work. It’s my device, let me assume the risk. Nanny bullshit.
most apps already work, and it’s been always that way. those that don’t, it’s because they depend on the google services system app (microg helps here). or they require google play integrity to pass which is not something that can be hacked around, because this is its exact purpose: denying to work on open source aosp systems. it is security, but not for you, but against you.
AOSP is Android in barebones so apps “work”, the thing is that most apps need services that are developed by Google on top of AOSP (google maps api, notificacion services, google pay) and that are hard to replace because they need costly infraestructure or years of constant development. On top of that Google is promoting/forcing the use of Google Play Protect so more apps need that layer now
I agree it would be good to have third party integrity checks to not require Google Services etc. as part of the chain.
In GrapheneOS, many Google Play integrity check pass, but payments still do not work. You are notified when an app uses the integrity API, but probably only because they have spent a bunch of work sandboxing Play Services. This is what you see when you look at those details:
I guess the obvious problem is that so many apps rely on Google Services, such as for payments, opening the store, checking for integrity etc. On stock android, you can’t pick and choose these services separately or use third party ones, unlike using a third party keyboard, for example. Everything is one big proprietary, data guzzling lump.
I think it’s cool trying to figure out a way to do this without google, but it still won’t solve the fact that credit card payments aren’t private and are linked to your identity. As always cash is the way to go.
Also if you are still going to have a credit card (I mean fare I have one too) why not just use a physical card rather than paying on your phone?
This is huge. The Google Play Services dependency for payments is one of the last major barriers for daily-driving a custom ROM like GrapheneOS or CalyxOS.
Currently if you want NFC payments without Google, your options are basically:
- Your bank’s website (clunky)
- Physical cards (works but defeats the purpose)
An open standard for payments would also benefit Linux phones (PinePhone, Librem) where Google services aren’t even an option.
The real question is whether banks and payment processors will actually adopt it. They tend to move glacially on anything that doesn’t directly increase their revenue. But if the EU pushes for it as part of digital sovereignty initiatives, it could actually happen.
i’m just guessing here but i think that the critical requirements to be able to run banking apps securely on your smartphone are:
- lockable/unlockable bootloader
- quality control of the operating system to make sure it doesn’t contain malware/spyware
- internet connection & open-protocol banking network
the first two parts are general smartphone/laptop security and operating system integrity, which can only be done through hardware/general software developers. Like i think we need reliable hardware manufacturers but also institutions that check that open source software doesn’t contain malware. Like when you run
apt install some-packagewho says that some-package doesn’t contain malware?The third one is the only part that is actually specific to banking. That’s a whole separate topic and has barely anything to do with the first two steps.
Like when you run apt install some-package who says that some-package doesn’t contain malware?
The Debian (or Ubuntu) package maintainer says that. Having an application package available in a distro’s official repository is an endorsement of the safety of that package.
This is something people need to appreciate before they go adding PPAs and flatpaks and whatnot willy-nilly.
interesting.
quality control of the operating system to make sure it doesn’t contain malware/spyware
if uou l9ok around, you should see that is not a requirement
PIX neles
Would be cool, but i doubt any users in the US can benefit from it since google is so dominant.
iPhone is dominant in NA.
This works be fantastic and I might actually switch at that point.
This is a fantastic initiative.
Why not just use cash? Untraceable, nearly ubiquitous acceptance, are they just too lazy to go to the bank?
in some countries it’s fallen out of fashion. in others, people are too lazy to bring a slim wallet with themselves and select the bills and coins every time they want to spend
