Play Integrity API

skydel0

Is there a way to add apps to this list: https://grapheneos.org/articles/attestation-compatibility-guide?

The Yuh banking app "https://play.google.com/store/apps/details?id=com.yuh" also started to use this API and does not allow me to login anymore cause of this API. So i wanted to add it there.

So sad that this happenz :(

Best Regards anyway

aop

skydel0 Just now I realised the same. A real shame. I might contact their support (info@yuh.com). I just posted a 1 star review with the statement "Unfortunately the latest version does not support GrapheneOS anymore and a link to https://grapheneos.org/articles/attestation-compatibility-guide. You might wanna do the same?

(To your question: No clue how to add the app to that list)

Edit: Competitor Neon still supports Graphene.

aop

Otherwise you might wanna contact relevant people from here https://www.yuh.com/de/about-yuh/yuhmans/ directly. I am sure firstname.lastname@yuh.com will do the trick.

GrapheneOS

skydel0 aop Can you confirm that our Play Integrity API detection notification shows up when using it? We can add it to the list.

borgo

GrapheneOS yes the notification appears.

aop

GrapheneOS Confirm too. "Play Integrity API usage" and "Yuh used the Play Integrity API" was shown. Yuh then simply responds with "Something went wrong. Please try again"

aop

borgo I don't think that's how it works. They'll just add it to the list to make it official that Yuh is (currently) not supported on GrapheneOS. Yuh would have to deliver a new app version that supports GrapheneOS. I propose you contact them (as described above) to let them know that there are customers that cannot use their app anymore.

borgo

Added 1 star in the reviews, everyone with the same problem please consider doing this too! After revolut also this bank blocks GrapheneOS, soon none will be left

GrapheneOS

borgo Revolut app is working again for the time being until they start enforcing the Play Integrity API. Hopefully, enough pressure can be put on them before they do that to convince them to implement support for GrapheneOS via hardware attestation.

DeletedUser516

I was blocked to log in yersterday but now i can log in and I no longer get the Play Integrity API notification. Anyway, I will close the account. Not the first time, i have issues with their service.

aop

DeletedUser516 Super weird behaviour. I tried to login by opening it from the home screen, same issue (couldn't log in). I opened the app through the Google Play Store (from where I installed it initially some weeks ago) and tried to login, and it worked. (That was the case now at 1405 CET, I tried both just behind each other). Now I can even login when I block the Play Integrity API. It's still the same app version (1.35.2).

Aru

When searching for an app on the Play Store, if Play Store says "Your device cannot run this app", is it related to the Integrity API? I have a Pixel 6.

spring-onion

Aru Almost always yes. The aurora store could come in handy here if the app does no more checks (upon launch for example) or has a broken implementation in general. But mind the possible security implications of aurora, especially if we're talking of a sensitive app here.

borgo

It works for me too now, same app, same version, changed nothing...

aop

borgo Let's see if I'll get a reply from them on my email. Would definitely keep you all informed.

patienttruth99

Question about this. As I'm unclear about what stage of use of the API an app is at.

Alladin Connect (garage door interface) was stalling on login and I got a Play Integrity pop-up from GOS for the first time. After blocking the API it immediately logged in, so I don't think "banned" is right, it I'm unclear.

I'm preparing to write to the developers. Anything specific I should be telling them?

aop

borgo does it still work? I am having issues today again. Are you using a vpn?

Watermelon

I suggest that maybe GrapheneOS could block this API by default, so that apps wouldn't be able to store its verdict and reuse it after manually starting to block it. Sure, it's also possible to switch off internet access/toggle off the Network permission, but some apps can only start with internet connectivity.

GrapheneOS

Watermelon That's not how it's used in practice. Blocking it also doesn't generally achieve anything and is only provided for a very narrow set of services which are using it but not yet enforcing providing a result. The main purpose of the feature is identifying the apps using it, not blocking it.

borgo

aop it still works for me (without vpn)