Discussion
The developers of Funda and Rabobank seem to suddenly block alternative mobile OS's, like @e_mydata and @GrapheneOS
They're likely doing this through using the strictest device attestation settings in Google's Play Integrity API.
Funda is the largest Dutch housing platform in the country (like Zillow), and Rabobank is the 2nd largest bank in the #TheNetherlands.
This is why we need alternatives within the mobile ecosystem.
#digitalsovereignty #EUPolicy #foss #mobile
@Gina @e_mydata @GrapheneOS I have started sending complaints to the EU DMA team for every case that an app started requiring Google Play Integrity Strong (remote attestation), such as e.g. the Volkswagen app. Hopefully they will start an investigation when enough EU citizens complain.
I hope that @thefirewall will also cover remote attestation, since Google is using it to try to murder alternatives. It's very anti-competitive and anti-sovereignty.
@Gina Both of these apps work on GrapheneOS. Nearly every Android app is compatible with GrapheneOS. Only a small number banning using any non-Google-certified OS with the Play Integrity API are unavailable. Neither of these apps does that.
GrapheneOS fully preserves the standard security model and features including hardware-based security features. It greatly improves privacy and security with major privacy and security features. It stays far ahead of any other Android-based OS on updates.
@GrapheneOS glad to hear it. I mentioned Graphene because I've seen Linkedin comments stating that "a couple of weeks ago Funda suddenly didn't work on GrapheneOS anymore."
@Gina We've gradually eliminated nearly every case of apps being incompatible with GrapheneOS other than the Play Integrity device and strong integrity level.
GrapheneOS shows a notification each time apps use Play Integrity by default with the option to block using it. That helps to rule it out as a reason apps aren't working. Blocking it is also sometimes able to bypass it for services not yet enforcing providing a result. Play Integrity is the only significant remaining compatibility issue.
@Gina We've gradually eliminated nearly every case of apps being incompatible with GrapheneOS other than the Play Integrity device and strong integrity level.
GrapheneOS shows a notification each time apps use Play Integrity by default with the option to block using it. That helps to rule it out as a reason apps aren't working. Blocking it is also sometimes able to bypass it for services not yet enforcing providing a result. Play Integrity API is the only major remaining compatibility issue.
@Gina @e_mydata @GrapheneOS If @EUCommission were to put sanctions on who's obstructing a transition to privacy oriented systems, well, it would have to first fine itself. See the digital identity embarrassing outcome.
Agreed.
Both do work on GrapheneOS, however. I am on release 2026071501 on a Pixel 9 Pro. Installed both through the Play Store in a secondary profile. Both do use the Play Integrity API (GOS notifies about this).
Funda did refuse to run on a profile that didn't have Sandboxed Play Services installed.
@Gina @e_mydata @GrapheneOS this also happened this week to my health insurance app, on an unrooted LineageOS.
Is this a coincidence? Maybe the app devs didn't change anything at all, but instead Google changed something in the Play Integrity service. They did this before: on Android 13, they "removed" the Device profile by making it a synonym for the Strong profile.
In that case, it might not even be intended by the app devs. Just speculating tho
@Gina @e_mydata @GrapheneOS Funda can go f$%k themselves, as I wouldn't use their app anyway (and as they're in the housing business they're basically legalized maffia anyway). But I'm very disappointed in this move by Rabobank.
@Gina @e_mydata @GrapheneOS But we already have minimum for the full independence, rest is just up to personal needs.
Proven by daily driving linux for a year in Finland and traveling across Europe.
@Gina @e_mydata @GrapheneOS
Okay, well, Rabobank was already an app I was unlikely to use (as are banking apps in general, but that's a story for another day). If I needed Funda at the moment I think I would send them a ticket along the line of:
'Sorry, your app does not meet my criteria for privacy. Until you resume /e/OS support, I will refuse to use the app, and open the sandbox in a private Vivaldi browser'
But that's me being extremely petty.
@Gina fundamis ook gewoon in de browser volledig te gebruiken, dus ik snap hun noodzaak niet hier voor
@Gina @e_mydata @GrapheneOS How can we deal with this?
Vendors switching to hardware attestation as suggested by GOS seems not to happen.
Making people aware might create public outrage, but I doubt it.
So what now? Second burner phone just for crap-apps?
Or might GOS implement something like a developer-setting to manually set or divert from hardware integrity status for certain apps in Sandboxed Google Play?
Install bonfire.cafe
Get the full app experience
