Possible incompatibility between in-app browsers and MFA

Cabradac

Hi,

I have a Google Pixel 9 running GrapheneOS.

My university (United States) has a MFA system based on Duo Mobile, uses the Blackboard app for managing classes, as well as a bespoke app for student recreation. Whenever I try to sign in to either of those two through their in-app browsers, the Duo Mobile application within the browser (it appears after I sign in with my school Microsoft account, where I then have to go into the Duo Mobile app on my phone and confirm the login) states my version of Android is out of date, despite being on Android 16. For further context, the university has a policy that Android operating systems more than 30 days past their end-of-life are blocked from using the service. I am also able to sign in to Blackboard through the Brave browser on the phone (exploit protection compatibility mode off), but not through Vanadium - it gives me the same "Android out of date".

My concern is that the way GrapheneOS/Vanadium handles in-app browsers doesn't report the version of the operating system correctly, or its security/privacy features otherwise don't play well with it. What version could it be reporting that's more than 30 days past EoL? I've already tried changing all of the settings recommended by the pinned comment on this forum for app compatibility in the Blackboard and student recreation apps to no avail. Because Vanadium (and by extension, WebView) is preinstalled, I can't change its compatibility settings there as far as I can tell.

Any help or advice is appreciated.

cupcake-alibi

I'm not sure, but perhaps you could install another webview from f-droid or smth? it may be "up-to-date" if you're lucky.

In any case, talk to your university and kindly explain your situation. you shouldn't be forced to switch to a less secure os "for security reasons".

Cabradac

cupcake-alibi Looks like changing the WebView is locked down as well. The option exists in the developer options, but you're restricted from changing it. I've even gone so far as to try changing it via ADB, but it reports that it "failed", and goes back to using the Vanadium WebView.

n3t_admin

While I have never interacted with these apps, I am not sure if this problem is strictly related to the WebView.
Do you have Play Services installed in the profile you're trying to log in? That may actually play a part in the process.
Another point about WebViews: they have to be whitelisted by the developers of the OS. I haven't looked through the source code, but I assume most WebViews (if any) outside of Vanadium aren't.
Another thing to try might be feature flags inside Vanadium, although someone who's familiar with that topic should chime in; I don't have the expertise to figure out which one might help.

Cabradac

n3t_admin I do have Play Services enabled on my main profile. I quickly made a new profile with only the apps in question as a test (no Play Services), but no dice - same behavior.
I also skimmed through Vanadium's flags and tried a handful of keyword searches, but I didn't find anything.

Cabradac

For anyone that comes across this, I found a workaround.

I first installed Waydroid on my desktop computer, which allows me to run my my student recreation app without the compatibility issues. I then set up Tailscale to enable communication between my desktop and my phone, which I leveraged through MeshCentral to remote into my desktop from my phone. Important note: MeshCentral (on Linux) only works if you use X11 as your display manager. That means I run Waydroid through a Weston instance, since Waydroid requires Wayland.

My solution is, effectively, to run the app through an Android emulator on a separate device, which I then remote into from my phone. The biggest pain point for me was finding remote desktop software that was compatible with my situation and had privacy/security that was good enough, or at least supported complete self-hosting and connections through Tailscale.

While not the most ideal solution, I hope this helps someone in the future.

cupcake-alibi

Cabradac It's unfortunate but funny at the same time that this complicated workaround (with a much larger attack surface I assume) is deemed secure enough while GrapheneOS isn't.