← Back to context

Comment by fsflover

4 days ago

> GrapheneOS has heavily pushed back against apps using remote attestation to restrict which operating systems and hardware can be used.

This sounds great. Could you give some examples of this pushing back?

https://x.com/search?q=from%3A%40grapheneos%20play%20integri...

Many of our posts about it heavily criticize apps limiting which operating systems and hardware can be used in addition to the Play Integrity API itself. Our focus is mainly on the Play Integrity API because it's the only relevant system resulting in compatibility issues in practice. We don't have to worry about Apple's App Attest API and we aren't aware of any app banning GrapheneOS with the Android key attestation API.

We've convinced dozens of apps to drop using attestation with user pressure. We've also convinced a much smaller number of apps to at least permit GrapheneOS and other alternatives chosen by them with the Android key attestation API instead of only permitting Google-certified operating systems. We aren't aware of any app using the Android key attestation API in a way which reduces compatibility since apps generally only use the Play Integrity API and have to be convinced to either drop it or at least use an alternative where they can permit non-stock operating systems based on verified boot key hash and non-Google roots of trust.