Most GrapheneOS users in Norway will know what app and feature I'm referring to, but for people who don't know: BankID (Norway) is an app used for authentication to all digital public services, and hundreds of businesses also use it to confirm customers' identities before they are allowed to sign in to their service or sign a document/contract. The app moreover has a feature called "faster BankID" ("raskere BankID") which uses FIDO2 to allow people to authenticate with biometrics for some services instead of using a password + push notification*. While the rest of the app works fine on GrapheneOS, "faster BankID" has never worked because the app is using the Play Integrity API when users sign up for the feature:
According to BankID, "faster BankID" relies on Google to approve of the operating system's "security" which means that, in BankID's words, "modified" phones might not be able to use the feature. In effect, GrapheneOS users are banned from using passwordless sign-in with BankID simply because GrapheneOS does not license Google Mobile Services (GMS).
BankID readily admits on their website that they outsource the work of performing operating system "security" checks to Google (my translation):
Some Android phones lack technical support, or so-called 'key attestation', which is required in order to activate biometrics. This is when Google confirms the security of the key management. For instance, if one modifies one's phone, it might occur that Google cannot accept it.
I have confirmed this with my bank's customer support, whom also added (my translation):
If you have GrapheneOS installed on your phone, it has to be removed. Instead, a "standard OS" must be used.
This of course has nothing to do with security, as GrapheneOS is objectively a more secure OS than Google's PixelOS.
While this is only a subfeature of the app, it's nevertheless a convenience feature that GrapheneOS users are blocked from using, and BankID ought to be made aware that this is not a secure way of attesting to an OS' security. There's also always the chance that they might extend the usage of Play Integrity to the rest of the app, which would be bad for GrapheneOS users in Norway, so BankID ought to receive pushback for this.
Here's what you can do if you're affected:
From the following page: https://grapheneos.org/articles/attestation-compatibility-guide#apps-banning-grapheneos:
In addition to leaving feedback for these apps on the Play Store, file support requests and leave feedback on third party review sites. Ask them to stop banning GrapheneOS and explain that it's a much more secure OS than what they permit which does not lose any of the standard security model. Explain that they can use the hardware key attestation API to verify that a device is running GrapheneOS to permit it alongside an OS licensing Google apps as they do with the Play Integrity API already. Make sure to push back against false claims that it has something to do with compatibility or security issues. The only reason they aren't permitting it is because we do not license Google Mobile Services (GMS) and these apps are enforcing Google's business interests rather than security.
Important that you link to the attestation compatibility guide so that you can show them that there's a way to allow GrapheneOS while still upholding the ban on other aftermarket operating systems if BankID wants to do that.
Note that BankID does not have a direct support line for private individuals, so you'll have to send the feedback to your bank and ask them to forward it to BankID.
For users who don't use the app, you can test signing up to "faster BankID" using an official demo for it on this website (select "sign up with Aletheia"): https://bidaletheiacurrent-tester.azurewebsites.net/
More information on the Play Integrity API can be found here: https://grapheneos.social/@GrapheneOS/112878067304840664
*At least for now, there's fortunately still the option of carrying a code chip around with you instead of relying on the app.