Comment by bigstrat2003

I've kinda migrated to the worst-case scenario already and it's really not that bad - for my use case.

I have an old phone (actually running LineageOS rather than stock) that works as you perfectly describe as a glorified digital token. This device doesn't come with me. There's no banking I need to do, on a day-to-day basis, requiring said token, that has to be done right now or the world will end. It can wait until I get home (and I usually use the bank's web interface from a desktop). This device has minimal other apps installed, which limits bank app accessibility of other app data, and other app accessibility of bank data.

Then my GrapheneOS daily driver serves my day-to-day needs with minimal data leakage, tracking, ads, other general paranoia-inducing modern-life shit.

I pay for things on a day-to-day basis with a physical debit card due to an existing habit of not wanting to depending on a single device for "all the things", so GrapeheneOS wasn't a downgrade, but it should be noted to others that whilst Google Wallet can run on GrapheneOS, NFC payments through the Google Wallet will not work due to Full SafetyNet requirements that GrapheneOS can not pass. Non-NFC items such as tickets and boarding passes have been reported to work (and I'm pretty sure I've used it for that, although Google Wallet is no longer installed on my device).

Having a separate phone as a "glorified digital token" is probably within the top 3 things you want to do anyway if you are serious about digital security.

See the recent discussion about pixnapping: https://en.wikipedia.org/wiki/SIM_swap_scam) from breaking your SMS verification.

> A free OS will empower developers to implement technical workarounds that could trick these apps into working there.

Not if they require something like hardware-backed remote attestation, and only accept such attestation from Google or Apple.

I'd love a practical Linux phone, and being able to run a deblobbed close-to-mainline kernel on a new-ish phone would help with that, but that doesn't really solve the most user-facing problem of mobile phones, the ecosystem lockdown.

And FSF has a history of creating important OS level software.

Like they have been doing for Desktop Linux?

And I feel like it undermines any effort to make free, featureful applications if the hardware itself can't be trusted.

You are mixed up 3 different tech stacks: 1. React Native has nothing in common with web apps except JS runtime. It uses "native" widgets for Android and iOS. You need to add a new "native" runtime for your free OS. There are some third-party attempts to add mac/win/linux support, but they are not feature complete as officially supported platforms. Again, your free OS will be step behind. 2. Yes, you can write PWA with React (Web), but PWA still have many missing features which offered by platform APIs of Android and iOS. Your app will not be in "feature parity" with "native" app. Especially banking app. 3. Electron apps are integrated with desktop platform APIs, you cannot easily port Electron app to mobile. Every time big company with big investments wins.

This won't help if Google/Apple/Microsoft roll out integrity checks for browsers, something which they have already suggested they want to do.

...and packaging my app as a PWA is going to help with cantankerous bank/ditigal-id apps, how, exactly?

I agree, but unfortunately I think the chances of that are just about zero. The reality is that the vast, vast majority of people don't care about software freedom. They care about the flashy marketing features in the newest iPhone (and competitors). I wish it were otherwise, but alas. Heck, you can't even get people to care about their physical freedom most of the time, let alone their digital life. It's hard to see this effort taking off as a result.

Do you really NEED to be forced to attest if you can make your phone look like any damn PC using a browser?

>Stallman had a good idea for free (as in freedom) software, but then "missed the forest for the trees" by focusing on the source code.

RMS is afraid of trees!

https://news.ycombinator.com/item?id=28419139

Safe hardware is super difficult

The only project I know of that really actively addressing the end to end problem is Bunnie Huang's precursor.

Work seems to be going on low-key: https://github.com/betrusted-io/xous-core

> What does it matter if you can use any OS you want if your phone is filled with SoCs which are bugged and backdoored by the state and/or who knows who else?

Perhaps. But how does this effort from the FSF do anything to solve that? They are (as far as I can tell) producing firmware, not hardware. If the hardware manufacturers are working with the government or whomever to spy on you, they will just not use the FSF firmware in that case.

> so just having a free OS isn't enough to prevent it

They have a free kernel not a free OS. Them not having a free OS is precisely what is the issue here.

For people without a viable alternative such as transferring their funds to a bank that does not require Google/Apple certified devices, this seems to be the way. The second phone does not even need to have a SIM card in it, except perhaps during set up. That phone does not leave home and is ideally be powered off with its battery removed when not in use. Everything else can be done on a free device, ideally using FOSS apps. Ideally again, this means no Facebook, no Whatsapp, no IoT crapware.

Luckily, here in the U.S. this is still possible. I run Graphene on a Pixel without Play Store compatibility layer and everything just works. Most of my apps come from F-Droid, with the notable exception of Whatsapp, for which a standalone APK is available. Unfortunately, it is proving difficult to get rid of Whatsapp entirely because of friends and family.

Yup. Right now that's something running graphene for me. I'd prefer full linux but the other options don't seem viable yet to me. When I tried the pine phone a few years ago its battery life was in the 3-5 hours range if I used the phone which is not sufficient.

Some banking apps require relatively new OS, so if you have an old phone with e.g. Android 8 and you can't upgrade (Android 9 removes certain important features), you are out of luck.

But then I would need to constantly charge two phones and keep two phones in my pocket all the time because I never know when I would need to do those things on the go.

If you're being serious, you're in for a rude awakening. POTS lines are dead and being replaced with VOIP and VoIP to pots modems on the premise. lots of cities have already started to grub the copper out and replaced it a long time ago with fiber.

Exactly. A simple phone that runs a browser I can trust that's also capable of running web-based apps is all I need. I already avoid running apps on my iphone whenever possible.

The phone I really want is as uncomplicated and open as possible and beholden to no corporate economic interests or privacy invasions.

Now that I'm retired I'm looking for a project to immerse myself in. This sounds like just the ticket.

Actually "open" is a misnomer, maybe it was a decade ago but it's clear that Big G has an effective monopoly over browser(s), the web "standards", and is gradually making them more user-hostile.

> There'll be little point to a free computer if it gets us denied service everywhere. At this point we're gonna end up marginalized, like second class citizens of society.

Given the apparent trajectory of the corporate/government model of organizing society, it seems like they're going to be the ones that will be second-class citizens.

Increasingly, browser-based online banking requires authentication with a proprietary smartphone app, where it used to accept other forms of 2FA

UBS bank mandates their "Secure Access" app as second factor even when logging in from a desktop. They used to allow the smart card reader for existing customers that had it as a work around for a few years but they disabled that.

Also many websites are making it remarkably hard to not use the app if they even remotely sense you're not on an actual PC. FB and LinkedIn aren't banks but prime examples.

To be clear I'm not saying that alternatives don't exist now. But it's a worrying trend that big businesses, and even governments in some cases, are moving away from such alternatives being available. Look for example at the proposed age verification scheme in the EU, where they don't plan to make a version you can use on a desktop (and even for mobile devices require you use a vendor-attested device). Sure, right now it's just for looking at porn. But it seems to me that once that settles, it won't be long (a decade or two) before you start to see government IDs require a similar mobile app. That's the kind of thing I fear happening soon.

Monzo bank in the UK doesn't have a web access (apart from very basic page where you can block your card and do nothing else, not even see your balance). They also retired support for older Android phones, so if you happen to use it on an old phone, you are out of banking. I, for security, refuse to install bank apps on my phone that I carry, but I have them on a separate phone that I have in safe place.

They more and more force you into 2FA through banking app

I'm starting to see banks retire their web sites and push the app. It's likely that in 5 years most banks will only offer apps.

In SE Asia, most banks I've used no longer offer any services other than through their app.

I agree, and I've done similar to this for mobile banking successfully. This is the way :)

However, I expect at some point they'll insist on biometric authentication.

That'd exclude people who can't use the biometrics. But one bank (Revolut) told me that they're dropping customers who don't have a passport or driving license in the UK, for KYC reasons that they said they were required to follow, despite there being a large number of people without either.

So I expect banks to have no problem excluding <x% of people in a discriminatory way, if they can find an excuse, eventually.

No, with some banks you can't.

I tried calling Starling Bank in the UK when my phone screen stopped working. I assumed they would have basic phone banking service.

They told me no. The only service they could provide over the phone was registering a new device to resume access to bank services via their mobile app.

Although they have a web banking service, which can he used on a desktop, that requires authentication via the mobile app too. It's not TOTP, it's their own thing.

As I needed to make a transaction, I had no choice but to buy a new phone in a hurry.to do it.

Several people suggest switching banks and credit card services, but I've found that not so easy. I have accounts with several banks (some for business), and 3 of them require use of their mobile app. Most credit card services I use also require use of their app. Some have websites that hand you over to the app at some point in the flow.

The next step will be for them to prevent you connecting to the cellular network.

Sorry, but no. Device attestation is another mechanism to track and ultimately exercise control over the user. It fundamentally goes against the freedom of choice. You want me to authenticate with multiple factors? Cool.. let me tell you which method I'm already using on all my other accounts and then tell me how to register that with your service. You want to "measure" my device? Okay, I'll take my business elsewhere..