Comment by simpaticoder
5 days ago
Why don't banks use PKI? It doesn't have to be in the users face. It might be that your app generates a keypair on startup and sends the public key to the bank server, and the bank server sends you a public key, and you talk to each other with a shared secret. Maybe even you have to go in physically to the bank with your device to set it up and attest the legitimacy of your private key. Personally I'd really love that.
They do often use hardware keystore keys for authentication and other purposes. That's a standard feature supported by all Android devices with greatly varying quality of implementation. There are even rare cases of banking apps using key attestation to provide evidence of those keys being in an actual hardware keystore which has been a standard feature on every device launched with Android 8 or later.
They want to stop people from using tampered or fake versions of their app which could be tricking the user into doing things. They also want to enforce using a device with a mandatory app sandbox and some level of security patches/protections intact. Most aren't willing to ban using highly insecure Android devices which haven't received security patches for many years, but it's trending in that direction.
Around 90% of banking apps are currently compatible with GrapheneOS. It would likely be more like 50% if we hadn't put a lot of effort into improving compatibility with a lot of workarounds for the bugs and problematic anti-tampering checks done by these apps. It would be closer to 20% if we not only didn't have that but also didn't have our sandboxed Google Play compatibility layer feature.
The remaining apps not compatible with GrapheneOS is mainly due the Play Integrity API device and strong integrity levels enforcing having a Google certified device running the unmodified stock OS. Google doesn't allow GrapheneOS to be certified. Certification also disallows many of our privacy and security features. It also isn't compatible with providing fast security updates and would waste substantial resources as it does for Android OEMs. Those apps need to be convinced to stop using the Play Integrity API or to use the Android hardware attestation API provided as part of key attestation to verify the hardware, OS and app are genuine. The latter only solves it for operating systems and hardware they choose to permit.
How do you see the not so distant future when the vast majority of banking and gov apps would require an integrity level higher thar BASIC_INTEGRITY? Which alternatives would you suggest to GrapheneOS users? A second device, perhaps?
We plan on having improved compatibility with banking and government apps rather than most banning using GrapheneOS. Those apps aren't banning it for any actual reason. We don't have to convince them to stop doing what they are but rather to add a bit of code to support alternatives meeting underspecified requirements.