I’m lucky my banking app works (GrapheneOS), as it’s now requiring 2FA with the app anytime I login on the browser. Can’t use an actually secure form like TOTP. At least they now allow passwords over 8 characters (yes, serious).

(Meme in comments)

  • viking@infosec.pub
    link
    fedilink
    English
    arrow-up
    53
    arrow-down
    3
    ·
    8 months ago

    Magisk plus DenyList luckily works for my banks. Couldn’t imagine not having a rooted phone.

      • viking@infosec.pub
        link
        fedilink
        English
        arrow-up
        29
        arrow-down
        2
        ·
        8 months ago

        Graphene only works for Pixel phones, and I don’t want a Google device.

        • lseif@sopuli.xyzOP
          link
          fedilink
          English
          arrow-up
          7
          arrow-down
          2
          ·
          8 months ago

          thats fair. device support is a major downside of GOS. but, remember: its not really the fault of the OS, as it requires a lockable/unlockable bootloader, which only pixel phones provide (at least in terms of mainstream phones). blame the OEMs like samsung

          • viking@infosec.pub
            link
            fedilink
            English
            arrow-up
            5
            arrow-down
            1
            ·
            8 months ago

            There are a ton of unlockable bootloaders. On my OnePlus that’s a matter of flipping a switch in the settings.

            • lseif@sopuli.xyzOP
              link
              fedilink
              English
              arrow-up
              4
              ·
              8 months ago

              can it be re-locked? i may be wrong, btw. this is just what ive heard.

                • PoorPocketsMcNewHold@lemmy.ml
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  8 months ago

                  That’s the main issue really, as it open the possibility to manage your device for anyone getting hold of it. Probably some debug attack methods also with it.

          • deweydecibel@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            arrow-down
            1
            ·
            edit-2
            8 months ago

            which only pixel phones provide (at least in terms of mainstream phones)

            Mainstream phones? Pixel is a smaller market share than Motorola, and Motorola has unlockable bootloaders, and lineage supports a fair number of them.

          • PoorPocketsMcNewHold@lemmy.ml
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            Only big manufacturers can really pay to control entirely the hardware inside it, and allow you to modify it. Checkout Fairphone for example. They’ve been forced to stop hardware security updates due to their chip manufacturer, who refused to continue supporting it, despite them trying to support their devices for plenty more years. This explains the choice with Google.

      • Azzu@lemm.ee
        link
        fedilink
        English
        arrow-up
        17
        arrow-down
        2
        ·
        8 months ago

        What are the security issues? Rooted just means the potential to give trusted apps root access. Of course, if you give an app root access that you trust but is then abusing that trust and being malicious, yes it’s a security issue. But if you don’t do that, the simple fact of having a rooted phone should have no security change in any way. (Ok, except for potential bugs in Magisk/su or whatever)

        • deweydecibel@lemmy.world
          link
          fedilink
          English
          arrow-up
          19
          arrow-down
          2
          ·
          edit-2
          8 months ago

          The whole issue revolves around the fact Google is presuming a device is compromised or being used for illicit shit simply because root access is possible. If they put in effort to detect/prevent the actual problems they’re concerned about, this wouldn’t be as big a deal. This broad punishment for simply having root access is lazy and ridiculous.

          It’s like if Windows apps just stopped working if they detected a local admin account. It’s patently absurd to assume the ability to access anything means the device is inherently “unsafe”.

          • Azzu@lemm.ee
            link
            fedilink
            English
            arrow-up
            5
            ·
            8 months ago

            But the previous commenter talked about security issues, you’re only talking about usability issues.

        • PoorPocketsMcNewHold@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          edit-2
          8 months ago

          https://www.reddit.com/r/GrapheneOS/comments/13264di/comment/ji54e19/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

          If you have the UI layer able to grant root access, it has root access itself and is not sandboxed. If the UI layer can grant it, an attacker gaining slight control over it has root access. An accessibility service trivially has root access. A keyboard can probably get root access, and so on. Instead of a tiny little portion of the OS having root access, a massive portion of it does.

          In the verified boot threat model, an attacker controls persistent state. If you have persistent root access as a possibility then verified boot doesn’t work since persistent state is entirely trusted.

          A userdebug build of AOSP or GrapheneOS has a su binary and an adb root command providing root access via the Android Debug Bridge via physical access using USB. This does still significantly reduce security, particularly since ADB has a network mode that can be enabled. Most of the security model is still intact. This is not what people are referring to when they talk about rooting on Android, they are referring to granting root access to apps via the UI not using it via a shell.

          • Azzu@lemm.ee
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            I’m pretty sure whoever wrote that was talking out their ass. The fuck is “UI layer” on Android, or rather, what does it have to do with it xD

            • PoorPocketsMcNewHold@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              8 months ago

              The actual Magisk prompt that ask you if you want to give root to such app. This UI layer.

              Although, i suppose it could be countered by explicitly refusing all requests or enabling a biometric confirmation

              • Azzu@lemm.ee
                link
                fedilink
                English
                arrow-up
                1
                ·
                8 months ago

                But granting root is not done by “the UI layer”, “the UI layer” is not running with root. There is no such thing as “the UI layer” as a separate entity, an app can have a UI layer as part of its architecture, but the UI is not running on its own. Just because Magisk shows you a UI for you to grant/deny a root request, that doesn’t make it insecure. Nothing is able to interact with this prompt except the Android kernel/libraries itself and Magisk.

                Only if you added an application as accessibility tool (or give it root) can it interact with anything within the UI. An app with a UI is generally not much different than an app on the command line.

                • PoorPocketsMcNewHold@lemmy.ml
                  link
                  fedilink
                  English
                  arrow-up
                  1
                  ·
                  8 months ago

                  It still create an attack vector, as it allows a potential extra method to get access to it, in addition of potential hardware exploits that i shared to gain root. Yes, you can minimize the risks correctly, but the user is the only real barrier against it, not the software anymore. The less potential way to exploit your phone, the better it is. You shouldn’t rely on thinking that such feature is fully attack-proof.

      • TWeaK@lemm.ee
        link
        fedilink
        English
        arrow-up
        6
        arrow-down
        28
        ·
        8 months ago

        GrapheneOS is made by diva developers who frankly should not be trusted. “We only allow Google phones to run our OS!” as if they don’t have a backroom deal with Google.

      • RaoulDook@lemmy.world
        link
        fedilink
        English
        arrow-up
        9
        arrow-down
        8
        ·
        8 months ago

        Can you compile your own OS from source for an iPhone and install it yourself? I don’t think so.

        I have done that with my non-rooted android, and I can do anything I want with my phones through the powers of open source software.

        Rooting is unnecessary now and that’s a good thing.

        • davidgro@lemmy.world
          link
          fedilink
          English
          arrow-up
          9
          arrow-down
          1
          ·
          8 months ago

          You can’t do that without unlocking the bootloader, and that alone will trip “root detection” (Play Integrity).

          Some apps take it further and won’t run if you enable Developer Options! (Or have any number of “hacking apps” installed, such as autotap apps that don’t even need root.)

          • RaoulDook@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            8 months ago

            Yes, I am aware of how it works. Unlocking the bootloader is not the same as rooting, and all my apps work just fine.

            • davidgro@lemmy.world
              link
              fedilink
              English
              arrow-up
              5
              ·
              8 months ago

              If they work with an unlocked bootloader then they would almost certainly also work fully rooted, with the advantages that brings (such as actual working app+data backups, limiting max battery charge, better automation possibilities with apps like Tasker, etc)

              I’d much rather switch banks than give up rooting my phone.

        • deweydecibel@lemmy.world
          link
          fedilink
          English
          arrow-up
          6
          arrow-down
          1
          ·
          8 months ago

          Who cares if it’s necessary? If people want to do it, they should be able to, without punishment.

          • RaoulDook@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            8
            ·
            8 months ago

            Well you can, and there is no punishment, so you should be happy.

            I imagine you probably think “punishment” is that some bank won’t let you use their app on a rooted phone. That is not a punishment, that’s the bank implementing the security that they deem necessary for access to their software, and is likely part of a license agreement that you agreed to by using it. You have no default entitlement to have free use of the software that anyone else produces unless the software developer’s license states that you do.

            Actual punishment would be if your phone gets bricked by the OEM for rooting it, or government authorities fine or arrest you for rooting.

        • kratoz29@lemm.ee
          link
          fedilink
          English
          arrow-up
          1
          ·
          8 months ago

          Rooting is unnecessary now and that’s a good thing.

          Rooting is always necessary, you can’t convince me otherwise, imagine not having root permissions in your Windows, Linux or macOS machine…

          Without “rooting” capabilities we wouldn’t have custom firmware for tech that is quite locked (like the PSP, Vita, 3DS and whatever OS they use), emulation would not be the same.

          Heck, even some iOS versions can be jailbroken yet, I cannot conceive a world where iOS is less locked than Android.

          You need to be the one who decides how your hardware is managed.

          • Farid@startrek.website
            link
            fedilink
            English
            arrow-up
            22
            ·
            8 months ago

            You are being downvoted because you’re factually wrong. While Android (especially on Samsung devices) had been getting more locked down over the years, even unrooted it has way more freedom than an iPhone. For instance, you can install any number of APKs, without jumping through any hoops.

            • deweydecibel@lemmy.world
              link
              fedilink
              English
              arrow-up
              3
              arrow-down
              2
              ·
              edit-2
              8 months ago

              For now. Google’s recent patterns would seem to indicate the future trajectory of Android to become even more hobbled.

              I doubt it will ever be as closed as iPhone but there’s a point where the door is technically still open, just not in a way that really means much.

            • Engywuck@lemm.ee
              link
              fedilink
              English
              arrow-up
              2
              arrow-down
              11
              ·
              8 months ago

              As a I said before, I don’t care about downvotes. Be my guest.

              • Farid@startrek.website
                link
                fedilink
                English
                arrow-up
                7
                ·
                8 months ago

                That’s ok an all, but I assumed that you do care about making a false statement, which was the point of my response, to let you know.