Hacker News Reader

Comment by beshrkayali | Hacker News Reader

I stopped using stock Android and went back to iPhones because I thought Apple cares more about privacy than Google does. Not exactly correct in all cases I know (ie. they both suck in terms of privacy), but it seemed like Apple users are buying in, so it might work.

Now I think my next mobile OS is going to be GrapheneOS.

Like others have mentioned, this is as big of a warning as anyone's going to get to get out of that locked-in ecosystem. On that note, the outrage is kind of useless if you don't skip buying the next iPhone. You should fully own what you fully pay for.

View on HN

GrapheneOS sucks for normies, first of all because it lacks GApps, which is essential for many popular apps nowadays.

One example to rule them all? Most banking apps refuse to start if you don't have GApps (i.e. SafetyNet). And no, microG does not count as solution.

Why banking apps as example? Because in the EU they are required after the PSD2 directive mandated "strong" auth requirements.

I'm amazed that banking apps are the make or break example for so many people when choosing a non-apple/non-google mobile OS. How much banking is everyone doing on-the-go?! Just use the website! Use the mobile website if you must!

Maybe you did not read my last paragraph?

so you can't login to a bank website in the EU without having their app on your phone? WTF. Really? When did that happen? I know UK isn't in the EU anymore, but NatWest (UK bank) doesn't need me to have an app -- I can get an sms code.

No, but (at least in my country) most banks have used the PSD2 directive as a way to phase out HW tokens and force their proprietary apps to customers. But PSD2 does not really say this is required to comply.

The only alternative they offer is SMS-based 2FA which, unsurprisingly, often has an additional cost.

All the banks I use (in brazil), either only have mobile app to access the bank, or they require the bank's app to use the site (the app generates a 2FA token, you can't use a third-party 2fa manager like authy).

In the EU u need an app on the phone in order to do banking on the website. The app authenticates transactions.

That's not accurate. I validate all my transactions through SMS like I always have despite the directive.

I agree, but I would say the situation is not so good elsewhere. See my comment: https://news.ycombinator.com/item?id=28135648

Most banks only allow check deposit by mobile (as opposed to desktop), but yes, desktop can do a lot. I'm incorporated, and some of my clients (usually new ones) will pay with a check, so without mobile I'll have to visit a branch/atm to deposit those.

And my banks still use SMS MFA, so I could login online using a dumber phone.

> first of all because it lacks GApps

Anything that completely blocks Play services is a win in my book.

Sweden is pretty much a willingly fully cashless society and you can still function normally without banking mobile apps, or with a stay-at-home-usually-off phone that you can use for bank app when needed, though at that point you can just use the website.

> Anything that completely blocks Play services is a win in my book.

In mine too, however...

Don't banks in Sweden require a mobile app for 2FA?

You can usually ask for a hardware device (called something like a security token device) to login with.

In Sweden you need BankId though, and it's really awkward to use their hardware thing.

It's actually faster than using BankId. And BankId is not a requirement, there's usually always an alternative.

Banking apps don't like rooted phones either, even if they do have GApps. My bank's app, though, isn't much different from their mobile web experience, so I just use that.

You might be able to hide root using magisk(?). Did at least work the last time I tried, and the safety net checks passed without issues on lineage os.

Yes but then you're playing a cat-and-mouse game. Defaults are a big deal, if you think larger than the individual level.

> Because in the EU [apps] are required after the PSD2 directive mandated "strong" auth requirements.

No. I recently set up an elderly neighbours online banking access. She has a laptop for some clerical work and email, but uses a dumbphone only.

All the bigger banks I have been using offer a hardware device to generate authentication codes. These usually come with some sort of camera (there are multiple systems) that reads a code of the screen and they require a your bank card.

I am sure not all the banks offer this, but it's so much better than some stupid app.

> All the bigger banks I have been using offer a hardware device to generate authentication codes.

I guess banks suck in my country.

For such things, you can have a dedicated device that runs the locked down proprietary stuff. Motorola sells some very cheap Android devices that would work for this purpose.

The situation really is unfortunate, though.

Stop putting all your eggs in one basket!

A cheap/used tablet is like $50-$100. Put your online banking apps and other surveillance-based-apps on it, and generally leave it at home. Mine has a red label on it that says "Full Take".

You're then free to secure your mobile device with things that will best protect your location and communications, without worrying about lazy/invasive apps complaining.

Also if you get mugged, an attacker can't make you sign into online banking and see that you have a bunch of money sitting in your accounts.

That is an interesting insight about the banking apps. The hypothetical mugger could make you login on the web versions although, so you will also need to not have your 2 factor banking items on the personal phone too.

I think compartmentalization can work for now, I have a Windows partition with a similarly limited scope - only for gaming.

Why only "for now" ? To me, compartmentalization is the future, as proprietary apps and platforms become ever more locked down. You'll have your "business device(s)" that engages with that world, that you're forced to compromise your Freedom for in various ways. And you'll also have your Free computers that run subversive freedom-preserving software that you can treat as trustable extensions of your own mind.

Back when everyone had a single device, trying out Linux used to be such a trepidatious affair because you had to write down all the installation steps, make sure you had the install media in good order, and hope that you'd come out of it with a computer that still booted some OS. These days $20 will get you an independent machine capable of running Linux, and you can tinker to your heart's content without affecting your existing environment.

"For now" because they are making it harder and harder to do it, and so, it's not a stretch to imagine a day where you simply can't do it. Or you can, but it will be rendered meaningless. For examples, look at how hard it is on phones to change the OS and even then, we're at the mercy of the AOSP remaning open and up to date. On desktop, Secure Boot is yet another wrench thrown into general computing. Or, nowadays, how do we really separate two browsing sessions? A private window is a good shot, but still there's ways to connect that to your normal browsing session.

The protocols and methods that can make the current ecosystem free feel like holdouts from a world that's passed already. I really really wish that the future is not closed, that we can still host our email and websites in 50 years, but when all key players want a closed and surveilled ecosystem, it's hard to imagine that remaining open is not a struggle.

Hence, "for now".

These developments are precisely why I think compartmentalization is the future. The lockdown trend is happening, for off the shelf productized solutions. Simultaneously, it has never been easier to obtain computing hardware that can run code of your choosing.

So to the extent that you need to engage with the locked down world, you need a locked down terminal that behaves like everyone else's (to within some margin that they keep trying to shrink). And to the extent you want freedom (computational autonomy), then you need a real computer that lets you run whatever code you want.

If the Internet became locked down to specific protocols, that could be a different story. But the same bifurcation seems to be happening to the network. MITM webapps are going censor-happy and implementing IP blocks and eager captchas, yet it has never been easier to set up a VPS running whatever protocol you want.

You're right that there's lots of advancements on both fronts. It's not nearly as lost of a cause as I implied in my previous comment.

Hail to Graphene being the official No Agenda Phone

https://noagendaphone.com

Why disable 5G? I was following everything until that point, but I'm not sure the reason for that choice.

I am curious as well. My guesses are a. 5G allows for metadata collection points b. 5G chips are much more expensive because of patents

Me too.

A; maybe, I'm not sure what extra that does above LTE.

B; I guess you could get a different phone that doesn't have it, for a little while longer.

I'm not sure myself, I just know they push Graphene pretty heavily on the No Agenda show.

probably no reason for 5g, expensive and most people have small need for this, 4g already very fast. phone data limited, expensive, even if on unlimited plan it slow down with much use, so no point in faster connection. have high cost for any modem and not yet even available in most location.

A phone with no agenda sounds like a phone with an agenda.

A; absolutely

B; It's actually a reference to the No Agenda show. https://noagendashow.net

Don't you think though that trusting a company based on what they say is less reliable than trusting a company based on what they do. Apple is a closed ecosystem, therefore you have only been able to trust what they say and not what they do.

Reply on news.ycombinator.com