Status of MitID app

matchboxbananasynergy

3.0.4 (versionCode 77) installed from Aurora Store 4.1.1 on 2023041100 on a user profile with no Sandboxed Google Play.

Apps works great.

@lbschenkel feel free to ping me when you need someone to test new versions. Happy to do it.

lbschenkel

matchboxbananasynergy Can you try out 3.0.5 and report here if it works (and in which GOS version)?

Duckduck

Works fine after the latest update all the way from install to actually using the app

I dont use GPS, installed via aurora

trilogy6202

Duckduck Interesting that MitID doesn't require GPS, I didn't know or expect that. Then it's actually only my mobile banking app and e-boks that prevents me from deleting my "Google Play" user profile.

Grkrz

trilogy6202 eboks and bank can be accessed via Vanadium. If this an effort you willing to take

Duckduck

Also apps like mobilepay says it requires GPS, but if you dismiss that promt, the app works fine without. Was also quite surprised that mitid works without GPS

trilogy6202

Grkrz Hmm why didn't I think of that. I might try adding e-boks and my mobile bank as PWA on my user profile with GSF and see how that works.

Grkrz

trilogy6202 I am blad that I was useful. I can confirm it works quite well.

trilogy6202

Duckduck Yeah I've been made aware of this in hear recently. Actually mobilepay doesn't even require GSF. It will give you a warning every time you open it but it will work nonetheless, except for notifications.

Grkrz

Duckduck the only concern I have with disabling Google services and not being connected to play store is that all apps like bank, mobilPay, bank app, mitID ect apps have to downloaded from Aurora store.
Aurora Store is OK for not important apps but downloading bank app I would say is a bit riski. Would like to heat your comments on that.

lbschenkel

I can also confirm that MitID 3.0.4 (77) + GOS 2023041100 works. Updated table at https://gist.github.com/lbschenkel/4199be415f2a139b64688ae74c92a7fc

lbschenkel

Grkrz Aurora is open source and downloads directly from Google's own servers, the binaries are the same ones you'll get from the Play Store app. If you don't compile it yourself, naturally you will need to trust the provider of the Aurora binary app (either Aurora itself or F-Droid).

Duckduck

Grkrz I agree with @"lbschenkel"
From what I read its tomato tomato. Though you would need yo manually check for updates. Also many of us here use GOS to get degoogled and for me this is the way. Otherwise a great part of it all will still be tied to Google, from my understanding. I have though read some stuff about Aurora being a nono as well. Hence the tomato tomato

trilogy6202

lbschenkel It's correct that the source is Google Play Store as Aurora basically acts as a proxy but I think there are some valid security concerns with aurora store related to lack of certificate pinning and lack of secure asset delivery. I haven't read too much into it so I don't really know how concerned one should be but I've seen it mentioned in here several times so I do actually think that @Grkrz do have a point.

If one have a user profile with GPS installed for banking apps I would probably advise them to log in to google > download the apps from the play store > log out again

Grkrz

Duckduck

Duckduck I was degoogled for over year or 2, I have just create google account lastely because I thought banking apps ,mobil Pay it would saifer to get from play store. Actually it was Ibschenkel that said he was downloading via play store and I have fallowed, as I thought that is the safest. So I think I will get back to aurora I guess.

dazinism

trilogy6202 if you are worried about somehow getting served a malicious version of an app it is possible to check the apk signature fingerprint of either the apk or an installed app to check its a genuine version.
see https://discuss.grapheneos.org/d/2133-question-about-the-install-available-apps-feature-for-user-profiles/17

dazinism

I dont think logging out again will help with anything as the Google Play Apps will know which account previously logged in. Even clearing all storage for the Play apps or uninstalling and reinstalling them wont sever the link with the user account as the apps will see the same ANDROID ID which is unique per user profile and app signing key. Google no doubt store that on their servers.

Grkrz

dazinism agree

matchboxbananasynergy

lbschenkel Works fine (launching, gets me to the setup screen). Version 3.0.5 (versionCode 78) on GrapheneOS build 2023041100 (Pixel 6).

Let me know if you need anything else.

P.S. If you want, I can put your GitHub Gist's link in the OP so that people can find it easier.

lbschenkel

I updated it and I can confirm that it works for me as well.

matchboxbananasynergy: yes, I would appreciate if you could put a link to the gist.

matchboxbananasynergy

lbschenkel yes, I would appreciate if you could put a link to the gist.

Done.

« Previous Page Next Page »