alt Hacker NewsTo whom it may concern:
There is an alternative to Google's proprietary and unprivate integrity API that every bank now uses (and is at the root cause of this issue):
Spread the word.
To whom it may concern:
There is an alternative to Google's proprietary and unprivate integrity API that every bank now uses (and is at the root cause of this issue):
Spread the word.
Nah. Unified Attestation is an initiative by some some companies that really have terrible security (years old kernels, drivers, firmware, often way behind on Android updates). They are also known for campaigns against GrapheneOS, including astroturfing. They also do a fair amount of eurowashing (in particular Volla, who sell UAE/Chinese phones as a European phone with a markup of hundreds of Euros).
If Unified Attestation would become a standard, they would use it to entrench themselves over GrapheneOS et al.
AOSP has an API for remote attestation attestation. Banks should just come up with a list of signing keys to be trusted. Heck, they can start here:
https://grapheneos.org/attestation.json