Hacker News Reader

Comment by arcanemachiner | Hacker News Reader

If this finally pushes adoption of truly open Linux phones, then this will end up being a good thing, and the greatest favor that Google could do for the open source community.

Tragically, Linux phones have languished and are in an absolute state these days, but a lot of the building blocks are in place if user adoption occurs en masse. (Shout out to the lunatics who have kept this dream alive during these dark years.)

View on HN

It won't though, because there's a ecosystem of banking/insurance/whatever apps that have bought into the android/iphone lockdown mindsete that people will simply be locked out of. Open alternatives can grow when there is a viable means of slow growth, and cutting off the oxygen to such things is the implicit intent.

> banking/insurance/whatever apps

I know banking apps are the typical example, but I've always wondered why. I use my bank's app maybe once or twice a year when I need to Zelle someone, which I only need to do when they don't have Venmo. (Unless we consider Venmo a banking app.)

I only have one bank's app installed, the rest of my banks I only interact with over their website, on desktop.

As for insurance, I've never had an insurance company's app installed.

Am I just an outlier here? Honestly, if I switched to a non standard OS, I'd be more annoyed about losing, say, Google Maps, Uber/Lyft, or various chat apps. Banking and insurance just don't come to mind at all as something I need my phone for.

I can't deposit checks over the website, and I use a bank with no physical locations near me.

That's true, but the notion that we're still using paper checks in 2026 is so crazy. And yet they remain the cheapest way to handle many transactions in the US financial system. Like a lot of small healthcare providers still prefer to receive paper checks from insurance companies because the electronic payment processors take a 3% fee.

Why won't they just use Bank Transfers? Using Checks or Credit Cards for Payments between companies sounds completely insane and stupid

Yes, it is completely insane and stupid. Direct bank-to-bank transfers require significant administrative work to set up, and may still incur bank fees. For individual consumer accounts most people can use Zelle but it's not universally available.

Funny how South Africa has a way more sophisticated banking network than the USA.

I think nearly every other country has instant and free/low-cost bank transfers, without relying on some Apps.

I haven't seen a cheque my entire life, and I'm born in the last century

Banks often use their app for a second factor auth. here.

My bank sends me an alert when my card is used to make a transaction - handy for spotting fraud.

I get an alert when a payment comes it - handy for knowing if a client has paid.

I can quickly check my balance - handy for knowing if I can afford another round of drinks.

I can repay a friend in two taps - handy if they've paid for dinner.

Is anything essential? No. Is it something people use multiple times per day? Yes!

Could all of these be handled through openbanking?

Yes

I can get alerts in email or messages, no need dedicated app for that, I can track there also my balance, so only useful thing app provides are easy wire transfers from phone, which I never do, if I wanna transfer money is much more convenient work big display, proper keyboard and mouse than from phone.

That's great for you but unfortunately the overwhelming majority of people do indeed regularly use these features.

We've cultivated a tech culture that can't stand the slightest inconvenience. People will give up nearly everything if it means avoiding the least bit of effort.

We are so boned

So yes if it weren’t for people wanting convenience the “Year of Linux on the Desktop” would have happened 25 years ago.

What do you suggest? Everyone carry around their desktop computers and our CRT monitors like we did when we wanted to play Quake with friends?

> What do you suggest? Everyone carry around their desktop computers and our CRT monitors like we did when we wanted to play Quake with friends?

The exercise would do people good. Jokes aside though, there is a nuance between completely inconvenient and designed for the marching morons.

You mean 80% of adults worldwide are “morons”? Have you ever thought that they may know something you don’t know?

If 80% of adults worldwide somehow became unable to tolerate the slightest inconvenience, then yes, I'd say they would be morons, but I doubt they are. I'm unsure where you're getting the 80% statistic from.

I used that little convenience of my smart phone and used the internet.

https://www.demandsage.com/smartphone-usage-statistics/

I am sure you are thinking I’m a “moron” because I didn’t drive to the library and use microfiche to find the information…

Or maybe you would have been okay if I used Veronica and searched Gopher sites like I did pre Web in the 90s?

yes, getting emails or text messages instead of having app alerts is luddism.

Get real, dawg

Uhh yes - when 90% of adults worldwide have moved to smart phones - yes you are the Luddite.

Email is for old people has been a meme for two decades

https://www.techdirt.com/2007/11/15/email-is-for-old-people/

Anyone who says "email is for old people" is a fool, at least on that subject.

Yes, because “bigstrat2003” said so. I work for a 1000+ consulting company and no one uses email for internal communications. Even for company wide messages leadership uses Slack.

Heck even when we first start a project we either federate (or whatever you call it) the client’s Slack workgroup with ours or we ask to be on their Teams channel.

Before working where I worked now, I worked for the 2nd largest employer in the US, even there most communication happened over Chime or Slack.

On a personal level you actually email personal contacts - in 2026?

I email my dad documents and photos I need printed (and he uses his work office's laser printer). I forward the billing statement I receive monthly from my family's ISP to my mom via email. And I'm "Gen Z"

And I’m 51 and far from a Luddite. I’ve moved with every technology transition since learning how to program in AppleSoft BASIC and 65C02 assembly. My 83 year old mother is less of Luddite some people commenting here.

She is a retired high school math teacher - been retired for 30 years - and she has used every popular word processor/suite from the original AppleWorks for the Apple //e and she was tutoring friends kids and helping them use GSuite and PowerPoint until 5 years ago.

She uses her phone for everything and she has up to date computers a couple of printers on her network and two ISPs just in case one goes out. She kept the legacy DSL account that’s not available to new subscribers and she has cable internet.

You can get email on your smartphone.

No, it's cool tho, worry about being "hip" and enjoy the authoritarian surveillance state that you are enabling because you've been indoctrinated to want "new thing" and to reject "old thing".

Yes because email is a secure way to send information…

"if I wanna transfer money is much more convenient work big display, proper keyboard and mouse than from phone"

You realize how ridiculous this sounds, right?

It reads like he made typos/autocorrect mistakes on his mobile phone!

Which is a pretty funny illustration of the gist of what he was saying… it’s easier to make mistakes on phones.

yes, work=with

I'm not doing autocorrect typos when I type on computer keyboard, also banking on no gapps rooted phone would be kinda PITA

You actually check your email regularly? How much effort does it really take to transfer a balance on a phone?

For Bank Of America it’s:

1. Click on “pay & transfer”

2. Click on “transfer”

3. Click on “From” and choose account

4. click on “to” and choose account

Then type in the amount and and click on the date?

Is it really that much easier on a computer?

I use email corner with push, so I have emails instantly with notification to my smart watch, all my clients send me tasks through email

yes, especially the 4th point, the entering all the recipient's banking details on real keyboard is much more convenient than switching the windows and checking some microscopic numbers in PDF document on smartphone same copypasting them one by one between different fields (and yes, there are many companies which still don't provide QR code in their invoice)

The overwhelming majority of the population of the developed world now considers the mobile phone as their primary (and often only) computing device. It's always with them, it's more accessible and intuitive than a laptop, and it's how they communicate with everyone. It doesn't matter if you prefer to do this or that on a "real" computer - most people would just do everything through the phone if they could.

It's surprising how we still see posts like these in 2026 on what should be a "future-friendly" forum.

2FA is a requirement in Europe. I can't log into my bank account without my phone being able to run the app.

But 2FA is moot if it’s the same device as your bank app, is it not?

Yes. Please tell my bank that.

They know. The EU directive is quite clear that hw tokens are to be preferred over phones. Banks are cheap though and violate it.

Switch bank.

It is in the specific case that you don't have biometric or PIN login set up on the device and you use a password manager that doesn't require authentication. In that case, the only factor is "something you have". Otherwise, it is still a multi-factor authentication because the device itself still represents "something you have", and your device unlock represents "something you know" or "something you are".

Nearly all the security value of 1fa is that it keeps your users from picking the own passwords.

2FA and Google SafetyNet are two completely different things. Your banking app can implement 2FA without SafetyNet.

It's Play Protect and Play Integrity now, not SafetyNet, in case anyone wants to look it up

I would stop using bank requiring phone app to do banking, simple as that, both my main EU accounts use sms verification codes and extra password, which is fine with me. If they will require an app, they will lose customer.

So what are you going to do when all of them requires it?

2fa does not mean smartphone. There are other variants too

The "app" is probably a web page written in JS. Rarely its a native app in either Kotlin or Swift but then you have to maintain 2 different apps in 2 different languages with 2 different OSes for the devs. So unless the app really specifically requires something special, its just a web page. Even (and especially) your banking app.

"I'm am just an outlier here?"

No. The "banking app doesn't work" argument against non-corporate mobile OS, raised incessantly is HN comments, is bogus

I want a "phone", i.e., small form factor computer, that can run something like NetBSD, or Linux. But I have no intention of using it for commercial transactions. Mobile banking is not why I want to run a non-corporate OS

I want to use it for recreation, research and experimentation

NB. I have more than one "phone". The choice is not corporate mobile OS versus non-corporate mobile OS, i.e., "either-or". I can use both, each for specific purposes

> I want a "phone", i.e., small form factor computer, that can run something like NetBSD, or Linux. But I have no intention of using it for commercial transactions. Mobile banking is not why I want to run a non-corporate OS

> I want to use it for recreation, research and experimentation

I am a firm believer that phones are personal computers and should have all the end user freedom we have come to expect from personal computers. I am totally behind what your saying. (The amount of irrational anger that wells up in me when I hear someone make the argument that phones are somehow not general purpose personal computers and shouldn't provider their owners software freedom would astound you.)

Personally, I opt out of services that require the use of phone "apps" and any potential attestation they provide. Unfortunately, I just offload those needs onto my wife and her iPhone.

Want to go to a concert in a TicketMaster venue? You have to have a phone. Pay to park in some places requires a phone. Mobile ordering for some restaurants requires a phone.

I don't think it should be this way, but it is. I think we need consumer regulation to insure software freedom on phones and curtail awful user hostile "features" like remote attestation.

Until that happens (if it ever does) there is a realpolitik with needing corporate phones for some activities that can't be denied.

So the world should cared to your needs when literally almost every adult has a phone even in third world countries?

Before you say “what about the poor people” in the US at least, even poor people can get a subsidized free phone through the UCF (?) government fund

Also see: no I’m not going to waste development time di you can get to a website I develop with JS disabled or so you can use lynx

Because phones keep tracking us and stealing our attention.

And everybody should have the option of open computer systems

So exactly how do you think an “open phone” will keep you from being tracked when you are tracked and can be triangulated via cell phone towers?

He's referring to his activity ON THE DEVICE. We know you can't stop the location tracking from the carrier. But that doesn't mean give up on everything else.

Worrying about random app tracking you - which is a boogeyman in and of itself on iOS - and nog worrying about the government tracking you is like being concerned about a mosquito bite when you have a bullet hole.

The faraday bag I keep with me in my backpack!

> So the world should cared to your needs when literally almost every adult has a phone even in third world countries?

The assumption that everyone has a "smart phone" running locked-down Android or iOS is unreasonable. Just as race, sex, religion, national origin, etc, are protected classes, the "phoneless" should be a protected class. Denying people who choose not to use a locked down phone basic interaction with your business should be legally equivalent to posting a "No blacks allowed" sign on your door, and the consequences should be the same.

> Also see: no I’m not going to waste development time di you can get to a website I develop with JS disabled or so you can use lynx

I don't see what this non-sequitur has to do with the exchange. I didn't bring anything up about Javascript.

Oh please, really? As a Black guy whose still living parents grew up in the segregated South. Comparing not being able to use a Linux phone to segregation is really taking it too far. You have not a single clue what it was like growing up in the Jim Crow South.

This conversation is officially done.

Those things that you mentioned you can do it on the website meaning also a open computer too

> Those things that you mentioned you can do it on the website

No, unfortunately some things can't be. There are venues that provide tickets exclusively via mobile applications, for instance.

Well fuck those venues. It's a small percentage. I've never run into one and I live in LA, a city with hundreds if not thousands of venues.

So you only get 98% of the world instead of 100%. That 98% is far more than the the 100% of 10 years ago. Everyone wants perfection when they've already got abundance.

It has been reported that Ticketmaster has exclusive agreements with 70-80% of US venues. It's great that you have all the choices you do. For me, in western Ohio, every major venue for hundreds of miles in every direction is an exclusive Ticketmaster venue. You can't gain admittance to any show in those venues without a phone that can run their proprietary app.

Ticketmaster is bullshit, for sure, but they're just one example of the problem of being forced to use proprietary user-hostile software.

See this is the bullshit I'm taking about. You can print ticketmaster tickets.

So much self victimization to avoid using open alternatives.

> See this is the bullshit I'm taking about. You can print ticketmaster tickets.

So much confidence for an incorrect answer. As cited elsewhere in the thread, some venues are "no app, no entry", and do not have paper tickets.

Once again, never heard of this. It must be a rare exception because ticketmaster allows you to print them. Back to my 98% argument.

Can you cite a venue that won't take printed tickets?

Edit: it looks like NFL doesn't take them, BUT you can go to the box office with an order number and still get in, so same thing.

"There are venues that provide tickets exclusively via mobile applications, for instance."

Turns out Ticketmaster still has ticket printing machines at such venues

Was at a game at one of them, claimed I had a problem with the app and after some negotiation at the ticket window a millennial printed me a ticket

Why do they still have the printers

The "I'm having a problem with the app" strategy can work in other contexts too. The phone can be configured so that a young person trying to help gives up

"Modern" software is highly fallible and everyone knows it

Ticketmaster is it's own particular problem that needs to be dealt with, even if it is emblematic of a bigger issue with companies demanding users to run proprietary software.

I have recent (October and November, 2025-- venues in Indianapolis, IN and Cincinnati, OH) personal experience with this. With one venue I was able to play the "confused old man" card (via phone) and get the box office to print my tickets and hold them at will call.

At another venue I called prior to my show and tried the same tactic. They told me flat out "no phone, no admittance, tough luck for you" and cited the warnings and terms on the Ticketmaster website that I'd already agreed-to. I didn't want to chance losing out on $300 of tickets I bought so I knuckled under and loaded the Ticketmaster app on my wife's iPhone.

I don't think it's as cut-and-dried as you say it is, and I don't have the stomach to risk being denied access to events I bought tickets for-- particularly at the pricing levels of today's shows.

When people have problems using apps, alternatives are often available

Perhaps this is why, e.g., venues that "require" apps still have ticket printing machines and still print tickets when there are problems with using the apps

The situation is not so "cut and dried" that no one ever attends an event at these venues using printed tickets instead of displaying the ticket on the phones they bring to the event

There are alternatives to apps that are sometimes used, e.g., when customers have problems, even when businesses try to "require" apps

As such, businesses do not always succeed in collecting the same amount of data from every customer

This is not to say customers who try to avoid unnecessary data collection always succeed, either

Generally, trying is a prequisite to succeeding

If most customers do not try it does not mean no customer succeeds. There are some who do, at least some of the time

I haven't had issues with the mobile apps of 3 of the most major US brokerages. They run fine on rooted phone. They do everything I'd want a bank to do anyway.

Ditch your bank if they have issues. If their retention department asks why you're leaving, tell them their app doesn't work.

> Ditch your bank if they have issues.

This is what I was thinking as well, TBH. I'm not particularly tied to any of my banks, I already did mostly switch off of BoA because their website was so bad.

Good to hear everyone's responses in the thread though, some stuff I definitely didn't consider.

Some banks' only interface is the mobile app. And in Europe people typically use their banking app for P2P payments (no need for an app like Venmo)

My main bank is Commonwealth aka CBA (one of the "big 4" banks here in Australia). For a long time, I held out against installing their mobile app (on Android), and managed fine with their web UI (and with 2FA codes via SMS). Then, 2 or 3 years ago, I needed to start using PayID (sort-of Australia's version of Venmo, ie free instant transfers, except it's supported directly by all the major banks here). And I discovered that CBA had (deliberately?) only added PayID support to their mobile app, you absolutely can't use it in their web UI (last I checked). So I had to finally relent and install the mobile app. I started out only opening it on the rare occasions when I needed to send money to someone via PayID.

Then, a while later, CBA pretty much phased out SMS-based 2FA (or they said that if you had the mobile app installed then you can no longer use it?). Only other supported option is in-app 2FA (no support for third-party TOTP apps). So I had to start opening the mobile app every time I needed a 2FA code. Then, within the last year or so, they made a new rule, that in order to log in to the web UI at all (just initial login, I'm not talking about sending money or any other high-risk action), you had to receive a push notification via the mobile app and tap "allow". So now I literally can't log in to the web UI without also logging in to the mobile app!

So, unfortunately, "just keep using the bank's website on desktop" is increasingly and deliberately becoming not an option. I assume there are many similar stories with other banks around the world.

I paid someone via payid via the web ui. Was via an email address. It was a while ago though and haven't used it since. Also I've never used the app since the blocked rooted devices, magisk stopped working (cause of safetnet) and moved back to sms "security". I just logged in then without having to enter a code. I do note you need to allow browser fingerprinting to allow the login to work. Otherwise it's some generic error.

I've made a lot of noise about it so maybe they've "unblocked" me to shut me up. Email the CEO so it registers a complaint. Make some noise. Definitely have another bank though as you can't just depend on one.

So, leaving aside the discussion about whether someone wants to use their bank's application or not, what's the bank response if their application just doesn't work in your phone? That you must purchase a new phone or be locked out of using your account?

I hope, now that the debate about our excessive reliance on American tech is on the table, that we also put limits on those essential services, like banks, imposing the usage of products from only two companies (Google or Apple) in order to operate. I think that goes at least against the spirit of the European Union.

> I hope, now that the debate about our excessive reliance on American tech is on the table

LOL, you couldn't even place a phone call in Australia without some US technology connecting the call. I should know, we setup the app that calculates your bill. That's from the US too.

As a fellow American, can you not?

You're definitely not alone. I just checked the list of installed apps on my phone and found three different banking apps that I completely forgot about because I never use them. I installed them because I thought it would be convenient for checking things on the go, but I actually just end up using the computer whenever I need to do real banking business. The only finance-related app I use with any regularity is Venmo for e.g. paying back a friend for covering dinner.

Another commenter mentioned needing to get alerts for fraud, but none of the financial institutions i'm currently doing business with have any trouble sending me text messages. In fact I have the opposite problem, I can't get them to stop using text for 2FA codes...

Sounds like you’re using Venmo to fill the same role as a banking app (sending and receiving bank transfers).

Many other countries simply rely on banking apps for these things, and don’t have a separate service for this kind of transaction.

Here in NL many banks (not all) require their iOS or Google app to log into their home banking on a PC/browser.

> I know banking apps are the typical example, but I've always wondered why.

It's because Google created this thing during backroom conversations with bank associations from a handful of countries.

Country dependent of course, but recently i observe steady push from banks to adopt mobile app. Some have webui neglected and glitchy, some openly announce sunsetting, some already killed web access only allowing app.

And this tendency will prevail as bank can collect way more data this way. Just a month ago one of banks that is often praised here sent me a letter saying “your IP activity doesn’t match your residence” (and i am not even installed their app, they pulled data from web ui usage. Imagine what happens when they get access to data mobile app can supply

Fair point - but then take national eID apps instead.

Take Denmark, for example: most banking apps use eID for login, so that problem translates 1:1. But other apps who do the same include the national school communications platform (which is pretty much mandatory for a huge chunk of the adult population, who need to look at it almost daily). Also: social security card (including health portal/doctor booking/comms), driver's license, bus pass, parking app, used-stuff-marketplace, ... eID is _everywhere_ because it's a good idea.

Sure, all of this can be done on a computer. If you're near one. Or you can have separate and physical cards, like we used to have. That still works, mostly: more and more services (eg. bus pass) are going digital-only.

Really, what we need is a top-down embrace of open-source-based platforms as being _as_ (or more) secure than the established tech giants. From governments down, organisations _should_ move away from locked-down (foreign) commercial interests.

I'm not holding my breath though.

Have you not had a company block you from doing something on the web and force you to use an app for it?

> I know banking apps are the typical example, but I've always wondered why

My bank uses the app for 2FA, and that became a sort of a standard in Brazil, AFAIK. Mine at least gave me the option of using an RSA SecurID or sth alike when I asked, but I don't know how much it would cost me.

My stock broker on the other hand does 2FA exclusively on mobile (and only Android and iOS). The same for the health insurer.

My car insurer didn't force me to so far, which I find strange, given their interest in tracking my location and speed.

These were some of the major factors leading me to give up on using a feature phone when I tried, a few years ago. It was a good experience, especially at those times of pandemics and political instability, but the inconveniences were many.

The best solution for this is to buy a $30 burner phone at Walmart and use it unactivated, tethered to your main de-Googled device. You can use the burner for only tasks requiring Play Integrity.

Make sure to leave one star reviews on all such apps that you run into.

Yes. However, I already carry a tethered hand-me-down quarantine phone where I install my work apps and undesirable apps like Whatsapp (for those loved friends and family that can't or won't install Signal). Carrying a third phone for "Play Integrity" starts being a bit much.

Anything movement that requires people to routinely acquire a second phone is doomed to failure (in the “this will never become a mass movement” sense)

Yeah, it's one thing for a bunch of HN nerds to do it- the masses will not, and the masses are what move the needle.

And if it is not “successful” then it’s literally making your own life more difficult for no real effect in the world

LMFAO what are you doing on your banking app all the time

It only has to be something I need to be able to do but can't once a month to be a dealbreaker.

In that case a two phone approach makes sense. I was willing to try that out, to give Ubuntu Touch a trial on my main phone. This might incentivise it even further for an off-ramp of the Google/Apple duopoly.

I’ve found the mobile websites for a lot of these cases to be fine. Not a great UX but not a blocker

Wait till you see how hostile Reddit is when you try and access via a browser on a phone

That’s how I browse Reddit actually. It is a bit janky, but I don’t like ads. Brave is reasonably good at giving you ad free Reddit on mobile

I only use old.reddit.com

Reddit is the epitome of enshittification.

And if your bank only does 2FA via app?

Complain. Mine wanted that, but after complaining they offered me SMS. If not, I'd have closed my account there. At least here in Spain there are plenty of banks that don't force you to use apps. I also leave bad ratings for banking apps from time to time, and bad comments on X.

Since before 2023, MFA has been mandated by the government in Australia [0], for all critical services, including banks.

One without, does not exist, or is in violation of their national obligations and likely to be cut off by the RBA.

The only "effective" complaint here, would be the gigantic effort to lobby for a change in laws entirely.

[0] https://www.apra.gov.au/use-of-multi-factor-authentication-m...

In my country there are regulations in effect too that mandate the use of MFA; however, using an application is not the only way to implement MFA, as I said, in Spain banks can use SMS, coordinate cards, etc., and they are all valid MFA methods. I think what these laws are missing is the obligation for the service (the bank in this case) to provide a MFA device if the user doesn't have one.

I’m old enough to remember the days that banking apps required Internet Explorer and didn’t work on Firefox. Eventually, they were dragged kicking and screaming to support all modern browsers.

Microsoft's shit show seems to be pushing Linux adoption

Don't banks/insurers/whatever have websites that are often mobile friendly?

In EU/UK, some are sadly app only. I avoid those. Many others are pushing apps as a 2FA, even if you use their website. You need to insist to get another authentication system, like TAN. Some governments are also pushing mobile IDs.

The best Linux for phones, SailfishOS, has a fairly good Android compatibility layer that runs many bank apps well. But despite that, it's an uphill battle. The network effect of the duopoly is gigantic.

So what you're saying is we go after the banking system next.

Decentralized banking is the future!

INB4 someone mentions some edge case like 'grandma got scammed' or refunds.

The Wero payment system will cover the entire EU but apparently doesn't have a web portal the way ideal has.

Soon we Europians will only be able to pay using either an iphone or an Android device.

Hilarious

They will say: hey, now you're free from Visa and Mastercard for your payments! (only to be forced into the Google/Apple duopoly, which is far worse).

In theory, it's possible to have a third party (other than Google or Apple) to provide attestation on third party hardware.

You can have a separate core and kernel to run such code. They don't have to be powerful, but they'll need to be small enough to be verified by the said provider. For most of the code that doesn't need attestation, they can be executed on normal hardware.

The provider also has to convince the regulator or banks to trust them. However, if that's solved, the user should feel no difference between pure Android and alternative platform plus attestation.

GrapheneOS supports remote attestation, but banks have to add the fingerprint of the official GrapheneOS verified boot keys:

https://grapheneos.org/articles/attestation-compatibility-gu...

Some banks even do.

There's no point. Remote attestation means your device needs to be corporate owned to be trusted. Even if you had your own linux phone, it wouldn't be able to interface with institutions such as banks and governments. They trust Google's keys, not yours. This doesn't quite end free computing, it just kills it for normal people and ostracizes us hackers who insist on owning our systems.

Not sure what gov require, but most credit unions do not use such lockdowns

They will.

Credit unions, at least in theory, are known for caring more about their customers. It'd be worth explicitly giving them the feedback that you use them via their website or via an app that works on an Open Source phone, and telling them that that's one reason you're a customer.

Fraud prevention. If they lock things down, they lose less money to fraud. I think they should just have to suck it up and eat the cost but obviously they don't think that way. Only a small minority even understands and cares about these issues. The money they save by trampling over our freedom is no doubt much higher than the value brought in by us. They will no doubt sacrifice us for increased profits if we force the issue. We have no leverage.

There is no reason whatsoever for a major corporation to not use remote attestation technology. Banks will use it because fraud. Streaming services will use it because piracy. Messaging services will use it because spam, bots. If you're the corporation, the user is your enemy and you want to protect yourself from him.

Governments want this too. Encryption. Anonymity. They need to control it all. Free computers are too subversive for them. They cannot tolerate it.

> If they lock things down, they lose less money to fraud.

[Citation Needed]

I see this kind of claim made often, but never backed up with evidence that remote attestation of consumer devices has any real-world impact on fraud. It sounds like it could be true because it would detect compromised devices, but it could just as easily be false because people with devices that don't pass are usually technically sophisticated.

GrapheneOS supports remote attestation:

https://grapheneos.org/articles/attestation-compatibility-gu...

Some banks have added their verified boot keys. I think it helps that GrapheneOS is well-known by now for great security practices (most likely more secure than all vendor phones out there).

> Some banks have added their verified boot keys.

Seriously?? That was very unexpected... Here's to hoping this becomes standard practice!!

Until Android is crippled it will continue to take resources away from Linux Phone development and companies that will launch phones for it

I got downvoted heavily about a year ago saying we need to abandon Android and the industry needs to pivot back to just putting GNU/Linux on a phone already.

Of course, now Google is doing what Google was always going to do.

Have a look at this post

https://news.ycombinator.com/item?id=46723594 from Emre @emrekosmaz

It is a smartphone that runs Android, launches Debian, and dual-boots Windows 11

Actual link https://nexphone.com/blog/the-tale-of-nexphone-one-phone-eve...

For me as a desktop linux poweruser, I find this potential transition pretty intimidating, I've never flashed a phone with a custom rom let alone switch to a completely different OS, and I am not sure if the phone can even be reset to its original OS, if things go south.

It's relatively easy. It's basically a command for each step you want to do and it tends to fail gracefully nowadays.

If you can install a linux distro you can flash a custom rom on a well-supported phone.

If it were more mainstream I could see GUI apps to manage all this for people, if they don't already exist. Idk I just use adb.

It's also high risk. I've bricked two phones doing it.

I've been flashing phones for over 2 decades and have never bricked a phone. How did you manage that?

Are you seriously implying that flashing phones doesn’t risk bricking them or you’re not aware of that risk are you serious?

> Are you seriously implying that flashing phones doesn’t risk bricking them or you’re not aware of that risk are you serious?

Yes, that is generally the case. As a general rule with an Android phone reflashing the OS itself or the bootloader carries no risk of bricking the device (meaning making it impossible to recover without specialized hardware and/or opening up parts that were not intended to be opened).

There are plenty of ways to "soft-brick" a device such that you might need to plug it in to a computer, and adb/fastboot can definitely be a pain in the ass to use (especially on Windows), but if you have a device with an unlocked bootloader it's very rare to be able to actually brick the device while doing normal things.

Now, if you're doing abnormal things like reflashing the radio firmware you can absolutely brick some devices there, but you don't have to do that just to boot an alternative OS and generally shouldn't be doing it without very good reason and specific knowledge of exactly what you're doing.

I'm not going to say there are no devices where the standard process to flash an alternative OS is dangerous, but none of the relatively common ones I've ever owned or used have been built that way because OEMs don't want their own official firmware updates to be dangerous either.

tl;dr: It is sometimes possible to brick a device by flashing the wrong thing incorrectly, but the risk of doing that if you are just installing an alternative OS through a standard process is basically zero.

I am seriously unaware of the risks and also flashing brand new phones :)

"flashing" a phone is largely the same as any OTA update. There's of course always a risk of it going wrong, disk failures are always possible, but it's exceptionally hard to do so accidentally. Especially with custom ROMs where they basically never include a new bootloader, so "flashing" is no different than installing an OS on a desktop system - it's just writing to the boot partition. Which you can always do again since the bootloader is still available.

It is not 'largely the same as OTA' on phones with downgrade protection. Once you lock the device again, it's game over because the bootloader refuses to boot an older version of the OS, and you cannot unlock the phone anymore. Happens all the time in the /e/OS and Fairphone forums.

It really depends on the device. E.g. Pixel is quite hard to brick. Though they do sometimes increment the anti-rollback version:

https://developers.google.com/android/images

In that case you have to be careful to not flash an older version to both slots and lock the bootloader, which is possible, because many non-Google/GrapheneOS images are often behind on security updates.

It is still largely the same, those downgrade protections apply to OTAs as well. Those anti-rollback don't brick the device, either. It might not boot to a working OS, but you can still get back to the bootloader to flash something newer. Unless you blindly lock the bootloader without testing if it boots first and the bootloader can't be unlocked again I guess, but that's quite a sequence of bad choices all around

It is still largely the same, those downgrade protections apply to OTAs as well.

But the Android SPL versions of OTA updates from Android vendors monotonically increase.

It might not boot to a working OS, but you can still get back to the bootloader to flash something newer. Unless you blindly lock the bootloader without testing if it boots first and the bootloader can't be unlocked again I guess,

This is false. As long as the boot loader is unlocked, many phones will boot the downgraded image fine. It stops booting it when you lock the boot loader and on many phones, you cannot unlock it again. You need to boot the OS to enable OEM unlocking again, but you cannot boot the OS because the bootloader refuses to.

The Fairphone community is full of people who though 'oh it boots, so I can lock', locked it and they were in a boot loop and had to send their phone to Fairphone to get it repaired for 60-70 Euro (I don't remember the exact price, but that is the ballpark).

There is an adb command that can fairly reliably detect whether the boot loader can be locked. But I'm not going to post it here, because people have to read the full flashing manual, plus in the past there was a bug where the anti-rollback would trigger even with a newer SPL.

At any rate, flashing is not for most people and it was much easier when there was no rollback protection. Of course, rollback protection does make phones much more secure.

---

I wonder if your experience is based on Pixel or older/other Android devices that do not have rollback protection.

Same here. Just follow the LineageOS steps.

Lots of people brick their phones by relocking the bootloader when the Android SPL before flashing was newer than the newly flashed OS when the phone has downgrade protection (e.g. Fairphone 6). The Fairphone/e Foundation forums are pretty full of people making this mistake. Then the only solution is paying Fairphone to fix it.

Potential for a brick varies massively depending on phone model, doesn't it?

I flash phones almost every other week. And tablets. I have been flashing since Androids came out. But never bricked. But maybe that is why I don't have any problems.

it's pretty much impossible to hard brick phone, you can almost always recover it

I'm running custom ROMs for the last 15 years

That describes relatively easy for you, but not for the average person who can’t even be bothered to change the default ringtone.

The challenge I've found when looking for instructions for flashing one of my old phones is the assumption of knowledge some rom builders have, or perhaps an assumption about their audience. This seems like it has the potential to bit someone in the ass because if they're relying on other sources like the lineageOS wiki or forum posts elsewhere for example there's no guarantee it'll stay available, complete, or relevant to their variant over time. It's an added burden for what is a gracious volunteer role, but it's a handicap if they want more people using the fruits of their labor.

I can't be bothered to change my phone's default ringtone and yet I've had very little issue installing LineageOS and GrapheneOS on the various phones I've owned over the years.

/e/OS at least has a browser based installer[0] for quite some supported phones. I definitely recommend trying it out, installing a custom os on my phone gave me the same feeling when I first ran debian on a laptop struggling under windows (even though the performance gains aren't that apparent in my opinion).

[0]https://e.foundation/installer/

The /e/OS installer is terrible though and often fails, even on their officially supported phones (like Fairphone). The standard recommendation in their forums is nah, just install /e/OS through the command-line.

Also, /e/OS has pretty bad security practices (shipping very old kernels, very old vendor firmware, and missing most AOSP security patches).

Also, be careful to follow the instructions really carefully. For some devices it's really easy to get the phone in a boot loop, where the only resort is to get your vendor to repair it. E.g. Fairphone 6 has downgrade protection and will become a brick if you relocked the phone when the old system's Android SPL is newer than the new system's.

Don't worry if you're not ready, just as on the desktop, there are pioneers ahead of you that will clear the way <3

Expecting Google to give up control of one of the only alternative operating systems is right up there with believing in the tooth fairy.

What you're saying should happen, but it will only happen when the government legislates it happens; which frankly they should be doing (along with nationalizing a few other software projects to be fair).

A trillion dollar transnational corporation with massive monopolistic tendencies will never ever do the right thing. Expect to force feed it down their throats.

In general, governments seem to be much more invested in making it illegal to have anything that is too open and too free. Even EU is lusting for draconian control features like chat control where you don't own and operate the software you installed on your device even if, at the same timem, they're trying to gnaw on the influence of Big Tech.

> Even EU is lusting for draconian control features

Even the EU??? Huh? Did you misspell 'especially' there? Because when your governments want to spy on your own citizens more than the big tech companies want to collect data for advertising, you probably have a problem.

The limitation of linux phones is hardware. I have been watching the progress of postmarketOS on the fairphone 4, and looks promising.

https://puri.sm/posts/the-danger-of-focusing-on-specs/

Sent from my Librem 5.

I don't care about specs, I care about functionality and price. The camera on the pinephone doesn't practically work because it is too slow and the quality sucks. You basicially cannot record videos whatsoever. I can't use the device for GPS navigation. I can run whatsapp within waydroid, but it isn't practical due to the battery life and startup limitations that imposes. The GPU on the pinephone sucks, is underpowered, doesn't support OpenGL ES 3 or vulkan, and the user interface is always slow as hell to navigate.

So practically I cannot use it as a daily driver.

Librem 5 does have enough GPU horsepower, a functioning camera, and good pmOS support. But $800 is a lot to ask to test out switching to linux with no guarantee that my workflow will work or I will have enough battery life. It looks like the librem 5 can't record videos or do GPS navigation yet.

I am looking at the librem 5 specs again. The EG25-G is probably a better starting point for the modem now that it has been better documented and reverse engineered as a result of the pinephone project. It is interesting that the L5 has a generic smartcard reader though.

> But $800 is a lot to ask to test out switching to linux with no guarantee

Commercial phones' costs also include the data value they continuously steal.

> It looks like the librem 5 can't record videos

It can: https://social.librem.one/@dos/115893142828953827

> or do GPS navigation yet

Yes, it can: https://forums.puri.sm/t/is-gps-supposed-to-work/21147/76

> or I will have enough battery life

Fortunately, you can replace the battery on the go. But yes, if you make no compromises, you will never win a tiny bit of freedom.

No, gnu/Linux is nowhere near usable as a daily driver mobile device for 99% of the population.

Besides having terrible battery life and security, it's just a hobby thing. Android has had millions of dev hours poured into it to be what it is.

In the 90s, you would have said the exact same thing about linux on the PC.

Free software ultimately has time on its side. As long as a project has enough mindshare to keep its momentum, it really is unstoppable in the long run.

Linux desktop on the PC also sucks.

Where Linux shines is the absolute for-profit cloud/server world.

Open source has places where it works really nice, bazaar is better at "wider" stuff (having an active community, etc), while cathedral is more deeper/better at vertical integration, etc.

Adoption would mean that orgs like the European Payment Initiative behind Wero would adopt Linux phones even other AOSP ROMs. Not seeing that. Banks and streaming platforms that require DRM are keeping most (non-activist type) users locked in.

It may push a minority of users who really care about open source to Linux phones. I expect the majority of users will grumble but cave and re-adopt mainstream Android or Apple.

But there is a lot of resources put into the android ecosystem already. Even open source apps like anki, syncthing etc

> If this finally pushes adoption of truly open Linux phones...

It won't.

Even if you have linux, there are still third parties that have control over your hardware. Even if you're using graphenos, you can't block the sim or the cellular radio stack, and likely other modules on the SoC, from at-will access to every sensor on the device. You can at least protect your files, unless there's a mitm or other vector that graphenos can't cope with. And at worst, they can simply clone all your encrypted bits and wait on Moore's law or sufficient cubits to go back and crack the copy, on the off chance there's anything they want with your data in the first place.

My phone has hardware kill switches for modem, WiFi/Bluetooth and mic/camera. All three together also kill all sensors.

If it's got a sim card, it's still phoning home and providing location data. You can't escape the panopticon. A faraday bag gets you mostly there, though, but the point isn't that you can maneuver against it, it's that the device and its operation is fundamentally compromised by design.

There's a whole lot of shady crap underlying the infrastructure and the hardware that consumers cannot touch, pinephone / librephone or otherwise. It's not designed for consent. At best you can gain ephemeral relief, but even that is illusory, because by simple process of elimination, differential analysis allows fine grained ID and tracking of people even if they don't have accounts, phones, interact with websites, etc.

It's not a shady cabal of lizard people, it's just the grubby natural alignment of interests by a wide ranging set of companies and regulators and groups who allow it to happen without imposing any accountability, and ensuring that the system remains structured such that no effective accountability can be imposed.

Extorting constant streams of data for adtech is too valuable and the entire thing is too complex for silly things like ethics to interfere.

> If it's got a sim card, it's still phoning home and providing location data

Only when the kill switch is on. I control it.

Also, it's possible to get AweSIM service hiding your data from the mobile operators.

For sure - and you can use WiFi only, set yourself up with a HaLow rig and give yourself a ~10mbps connection anywhere up to 10 miles from your home, suitable for voip and low rate streaming, throw in VPN, and remain completely off-net as far as cellular networks go. I'm actually planning on using a wireless touchscreen and mobile halow/raspberry pi network/storage stack to completely replace my phone, but the bigger issue is automated tracking of everything - if you're the only blank spot in a sea of known individuals, it's just a matter of seconds to id you, since everything everywhere about everyone is tracked online.

We should be enforcing informed consent regulation of network infrastructure, treating privacy and anonymity as synonymous with liberty and freedom. Allowing the system to operate as it does is a choice; those with lots of money get to make it grow by exploiting a constant invasion of privacy with no concurrent return to the society being exploited.

Phones aren't built to be privacy respecting, and kill switches are a mitigation of a symptom, they don't do anything to address the disease.

What a lame and useless doomer POV. Do you refuse to go outside because a lightning strike could kill you at any instant? Why let things that aren't in your control (yet) stop you from taking control of the things you can now?

FYI: GrapheneOS only support devices with isolated radios. These radios cannot access other sensors. More background: https://news.ycombinator.com/item?id=46841033

Reply on news.ycombinator.com