Hacker News Reader

Comment by riedel | Hacker News Reader

Lineage is as much standard android experience as you can get after market without any gaming/styling mods. If google was series about AOSP and sustainability they should embrace lineage and at least give a non-rooted lineage with a relocked bootloader on pixel phones a safety-net pass. Lineage has been very careful to not piss off google by not including microg or alternative webview signatures or means to circumvent device attestation. This love is not returned. If supported it would be a way also for other manufacturers to give their devices extended lifetime support (and allow bootloader relocking with lineage). Without safety net, people cannot use it for e.g. banking if they do not want to get into the cat and mouse game of magisk or trust shady indian enthusiast custom builds (like me because I am currently lazy/busy).

(I am writing this on a Redmi note 10 with lineage 21)

View on HN

DivestOS is a slightly modified Lineage version that officially supports relocking on some phones (in contrast with Lineage, which I think can be relocked but explicitly tells users not to do that). It also has sandboxed implementations of both official Google services — ported from Graphene, I think – and microG.

I'm using it with microG, bootloader relocked, and it seems to pass SafetyNet this way – at least the apps that didn't work on Lineage seem to work here. (I haven't yet tried Google Pay, though – I think it will require proper GApps.)

https://divestos.org/

Edit: by the way, banks requiring hardware attestation is probably a U.S. thing – in the EU and ex-USSR countries banks seem to not care about that at all (although some don't like it when you root your phone).

Yeah US companies are weirdly strict on this. The McDonalds app won't even work if installed through the Aurora store, it has a custom screen that says it won't work if it wasn't installed through the play store :D Ridiculous. It doesn't even handle payments here in Europe, you still have to pay at the kiosk.

Oh yeah you're right! McDonalds and Revolut are the only two apps that don't work on my phone no matter what I try. (Those and the phone-as-a-card-terminal apps, but that's totally reasonable.)

> but explicitly tells users not to do that

They set the vbmeta header flags field to 0x3, which effectively turns off all of AVB (Android Verified Boot). I'm guessing they do this because they want to allow the system partition to be writable (eg. for folks who flash additional things on top of LineageOS).

With unmodified LineageOS, if you configured the bootloader to use LineageOS' public key and relocked it, there would be no security benefit. To enable AVB's signature checks, the flags field needs to be set to 0, which requires re-signing LineageOS with your own key.

> Lineage has been very careful to not piss off google by not including microg or alternative webview signatures or means to circumvent device attestation. This love is not returned.

I wish they weren't so pedantic about that. At the moment if you even mention microg in the lineage channel you get insta-banned.

As you say their hard stance is not doing them any good with Google anyway, they're ignored either way. And MicroG is a really good solution which can replace google services like cell-based location with much more privacy-sensitive alternatives. They even implemented the corona bluetooth protocol during the pandemic! The only place it uses google's services is for push notifications, necessary because most app server infrastructure doesn't have the ability to communicate with anything else. But it does so in the most privacy-sensitive way possible.

At least the good folks at https://lineage.microg.org/ provide a great fork with microg built in.

Is anyone here daily-driving microg and can share their experiences? https://github.com/microg/GmsCore/wiki/Implementation-Status does not exactly inspire confidence.

Definitely not everything works with microG, it kinda depends on your daily usage, for me, I have 3 banking apps working by installing additional modules to have the security checks bypassed(FYI, not all these kind of app uses SafetyNet or Play Integrity), but some apps from government doesn't work so I had to give up on those, other than that it's been a pretty nice experience since about 6 years ago.

Weird!

Here in UK, using microG, banking apps for Nationwide, Starling, Revolut, HSBC all work with no issues.

Generally, I face no issue using any app.

Location services and notification both work reliably.

It's best to try it, people use different subset of apps.

As I replied below, everything I need works, including a number of banking apps.

I used to use Lineage OS with microG, but now I use iode, very similar.

Note, I never patched or installed something besides microG ever, so my experience is as close to pure microG experience as possible.

I never understood the banking app thing. I can use my banks website to manage my finances, using my built-from-source Gentoo Linux computer. Why must a phone then be totally locked down?

Bank would probably prefer if they could lock that websi5e down as well.

Banks are all form over function.

I came to my bank to discuss a mortgage and I saw them log into their environment. A nice Windows environment with bright blue title bars and big red X buttons. In other words, Windows XP for which even the long term extended support has long since passed.

Did you mean the other way around?

They've tried: https://en.wikipedia.org/wiki/Web_Environment_Integrity

> I can use my banks website to manage my finances, using my built-from-source Gentoo Linux computer.

Only because hardware attestation is not yet a thing on desktop browsers. Google and Microsoft are working hard to change that, though.

I recently gave up with the cat and mouse game trying to keep my banking apps working and defected to an iPhone. If I'm going to be locked down, Apple does it better. Sorry, Google, your main advantage to me over Apple was flexibility. Of course, now I have to deal with the completely locked down App Store, which is a diseased pit of useless subscription and ad riddled apps. I do miss f-droid. Why is my only real choice between two platforms that are actively antagonistic toward me?

Because it's too late to lock down computers, but that's the trend with every newer platform such as phones, tablets, TVs, cars, etc.

You might be interested in this https://www.nytimes.com/2022/07/08/business/korea-internet-e...

it’s disappointing that people have to go such lengths in order to have a mobile device that is not conspiring against their wallet or ballot

I don't think Lineage want to work for a device manufacturer, that's how it got formed in the first place.

Reply on news.ycombinator.com