GrapheneOS is currently the blessed child. Like CyanogenMod previously. They are "permitted" to access to Google Play Services because their work hardening Android currently benefits Google.

Once Google feels like there is sufficient stability and compatibility with hardened memory allocator and tagged memory (and when they can get Qualcomm to support it across their range), they will make harder, until impossible, for Graphene.

An old article [1] but:

> Google’s Android—and [Open Handset Alliance] members are contractually prohibited from building non-Google approved devices

So to compete you'd have to create a compatible Google Play Services as well as find a supporting manufacturer. Samsung managed their own competing apps and store [2] for a while along with Tizen, likely for leverage or theoretical pivot. But has since dropped that effort.

[1] https://arstechnica.com/gadgets/2018/07/googles-iron-grip-on...

[2] https://arstechnica.com/tech-policy/2021/07/google-bought-of...

I would say Ubuntu Touch + a Fairphone. Graphene is too reliant on Google.

> Android users need to switch to Graphene.

Which supports only Pixel devices.

> Android users need to switch to Graphene.

Doesn't GrapheneOS supports only Google Pixel smartphones now? For most of the users, that would mean changing their phones beforehand. And if we're talking about common people (especially not in US), it's not even everyone who can afford that. Moreover, in my opinion, by buying Google phones you're feeding Google, and I, personally, would like to avoid that.

I keep hoping for something more radical like Jolla and SailfishOS taking off or postmarketOS becoming a true viable alternative but as things are looking like now there's a better chance we'll ditch phones altogether in 10 years when smart glasses will replace them instead.

I tried. But then I didnt get access to essential services like banking and national resources.

The only reason I have not switched Graphene is because for reasons I do not understand, Graphene OS is very closely tied with Google hardware.

I bought a /e/os Fairphone instead.

I know Graphene has innovative security measures, do you happen to know whether that includes anything wrt. phishing or social engineering?

(For those who haven't been following along: this whole affair started with phishing. People were social-engineered into installing an app and a little later their bank accounts were empty. A big issue in various poor countries.)

I get it, but it really sucks that Graphene only works on Pixel hardware. I switched to Samsung with my last phone.

Not really a solution at the moment if you do not want to give money to Google by buying a Pixel (hopefully the deal with Motorola will work).

Long term I would probably have more hopes in https://postmarketos.org/

Yes but they have signed up with Motorola so that is changing

https://www.androidauthority.com/grapheneos-motorola-partner...

> we'll ditch phones altogether in 10 years when smart glasses will replace them instead.

Billions are spend right now to make sure the glasses also run Android or iOS. So far, Google, Samsung, Magic Leap, RealWear and Vuzix are working with/on Android XR, and obliviously Apple is working on AR/VR iOS.

Meta and a couple of smaller startups are doing something in-house, but I don't give them much chances to get an ecosystem going.

Correction: i did get bank access. I just couldnt log into the bank without a google or apple controlled device.

I bought a second hand pixel when I had to buy a new phone. Still better for the planet than buying a new fairphone anyway.

Give it a year, we may have GrapheneOS/Motorola then ...

* (March 2026) Motorola announces a partnership with GrapheneOS Foundation - https://motorolanews.com/motorola-three-new-b2b-solutions-at...

lol, this problem stopped me from installing GrapheneOS early. But now.. I removed banking apps by myself because my state require room them to collect phone fingerprint and access to location EACH time they opened. So... looks like now nothing stops me

Those reasons are explained clearly and openly. Ironically, your /o/OS is way less open than GOS on Google hardware.

Pixels are consistently "third party Android builds friendly", plus GrapheneOS has a list of required security features (beyond their control): https://grapheneos.org/faq#future-devices

e.g. first one in the list:

> Support for using alternate operating systems including full hardware security functionality

GrapheneOS wants users to lock the bootloader (≈enable Secure Boot) after install by providing user signing keys (avb_custom_key) -- that already seems to leave only Pixel, Nothing and Fairphone.

https://github.com/chenxiaolong/avbroot/issues/299

It's because only Pixel devices have proper hardware security to build anything secure on top.

> do you happen to know whether that includes anything wrt. phishing or social engineering?

Yes. For example if you install an apk from an unknown source (like a random website via browser or messenger) it will warn you what you are about to do and what effects that has.

You don't need to block stupid behavior. Just make sure users are well aware of their actions as long as they actually read warnings.

Korean manufacturers are even worse when it comes to privacy violations.

I use a Samsung too. The bloat, dark patterns and enshitification with every update are even worse.

I think the point they are trying to make is that in the terms of service Google says they get to define what is malware (halfway through article) so the author is trying to point out that exact danger: what happens when Google gets to randomly call things malware.

I have the opposite opinion, Google is doing a lot of garbage in the name of "Security", time to play their game and report their control on Android as security vulnerability

> Doesn't GrapheneOS supports only Google Pixel smartphones now?

For good reasons. Most other devices arent secure enough to guarantee privacy. Especially not if loaded with a custom operating system (most devices don't allow to verify the boot chain with a custom OS)

> And if we're talking about common people (especially not in US), it's not even everyone who can afford that.

You can get a new Pixel 9a here in europe for around 350€ and it will be supported at least until April 2032

> Moreover, in my opinion, by buying Google phones you're feeding Google, and I, personally, would like to avoid that.

Google phones are surprisingly open and work well. Google takes a pro-user stance here that is extremely rare in the ecosystem, so why not support this product?

Honestly don't think that would be so terrible, with how bad and locked down the mobile ecosystem has gotten.

Rolling the dice on a new technology could wind up being much more favorable.

FWIW, I submitted an EU DMA complaint (Art 27 report) against Alphabet for unfair gatekeeping against third-party distributions like GrapheneOS via Play Integrity. More info: https://github.com/AlexAltea/blog/blob/master/posts/2026-06-...

Convincing developers, especially bank and gov apps, is near impossible and won't scale well. Going after Alphabet for not meeting DMA obligations seems the easier path. Might not go anywhere but worth a shot.

Graphene OS user here. Almost all of the apps I tried work fine. All the banking apps I use work. Have you tried reaching out to the app developer or the service and explaining what Graphene OS is and asking them to support it? I was able to persuade one app to do it.

[1] https://privsec.dev/posts/android/banking-applications-compa...

That's one of its primary arguments: besides the hardening against exploits, they're considered such a safe OS because you cannot access your data either and give the wrong app root access. Everything lives in a sandbox. Whether not being able to grant full access to e.g. adb shell, Termux, or Restic is what you want is a personal choice, but it adds a layer of security against any malware that tries to get you to grant them root access

This is also the argument they use to try to convince app vendors to add their keys to the allowlist, because the app makers can trust that their DRM will be active (if Netflix sets a "no screen recording" flag, you the user cannot circumvent it by e.g. reading /dev/fb0). It should have broader compatibility than other FOSS Android builds (when running the officially signed version of course, you can't compile it yourself and expect such apps to run there)

It is not an OS with bubblewrap, you can still mess up your privacy / security if you want to, that includes phishing and social engineering.

Well… you can run android without google? The problem is that essential security services require apple or google devices and you as a member of society need the security services.

I thought the same thing but he apparently has a point. The stated purpose covers only a tiny sliver of the capabilities. The agreement points to the TOS where it (last time I looked) says service may be terminated at any time without stating a reason. Nothing guarantees it won't be used for things other than security. And finally he has a point where it also doesn't really do much for security.

If we ask their fine search engine, the AI helpfully explains malware to be software designed to gain unauthorized access to disrupt, extort payments and/or hijack devices.

If you still think the shoe doesn't fit, imagine what would happen if one managed to create an app with the same capabilities. Google would remove it immediately for being malware. Obvious malware.

Buy second hand

They're allowed to do it "to the extent that they are strictly necessary and proportionate ... provided that such measures are duly justified".

It remains to be seen whether the EU decides that this measure is strictly necessary, proportionate and duly justified. They sometimes do the right thing but I'm not getting my hopes up.

They did? There is the whole "alternative app stores" kerfuffle going on right now between Apple and the EU.

Not sure how well swatting works in the UK, and pizza deliveries are all pre-paid.

But yeah, you could have a loony turn up.

This is a somewhat good reason to make an US LLC with a mailbox rather than sharing your actual address. It can be much more privacy oriented.

No, Google is barred from providing any services to them by the US government.

not like that no, some US carriers don't allow them though like AT&T blocks you to google or apple phones. for them only pixel supports a way out with graphene.

No, they use AppGallery and HMS.

Excellent, I emailed them too but no reply yet. Yeah, given that we should be able to choose what app store to install, this seems wildly illegal.

How long before they take that option away?

Raise it at whatever level we can.

I've seen more outrage on HN posts about license changes than those related to this. I mean we are in the midst of one of the biggest rug pull of our lifetime and the response was not even remotely proportional. I wish it was a atleast a fraction of what it was during the SOPA act.

Not even businesses that could be hurt by entrenching Google more in the mobile space are acknowledging the issue.

That makes me think may be all the outrage at the SOPA time was probably "promoted" because it aligned with their commercial interests or may be Google is all too powerful and too deeply entrenched that nobody wants to upset them.

Shame has ceased to be an applicable concept for anyone “important” enough to get free media attention.

Then tell the courts to stop fining them and start fining all the closed platforms.

There is a clear legal asymmetry where allowing competitors on your platform makes you liable if they complain, but blocking out everyone except for yourself is a totally ok and legally rosy way to do business.

The Librem phones do exist and people use them.

Did it take the world by storm ? No.

But it exists, has users & is building the case (together with Sailfish OS and others) that having an abusive mobile OS duopoly is not the desirable state of matters.

> because the average people don't know how to properly secure their system, and Linux is not a restrictive-by-default system. It will be a malware nightmare if you ship Linux on a phone as is.

Linux is a kernel. A Linux-based distribution decides what the defaults would be. Why, in your opinion, would a Linux distro targeting phone-ish ARM64 hardware be problematic? Why would it be a "malware nightmare"?

I was surprised to hear Librem failed, but a quick search show this is not true. Quite alive and hopefully well.

Governments plan to use google play for government services. It is just a matter of time before it is required for you to use it.

https://news.ycombinator.com/item?id=48730729

More and more sites require you to use it be it github, or even fdroid (via gitlab).

It's nice that you have that luxury, but that makes you an anecdote in a world where folks need a smartphone just to access banking or government services.

Banking has slowly been transitioning in this direction as they close brick and mortar places. I'd have to drive 20 minutes to cash a check (which is still sadly common in the US in certain industries).

Google Play Services is independent of Android releases and will update itself automatically, though I believe you can disable this by uninstalling a specific system app with adb.

I started de-googling a few weeks ago. I don't really know what I'm doing but it's kind of enjoyable to learn. Graphene OS with F-Droid and I'm most of the way there.

I still use the play store for some apps unfortunately. Also google maps, gmail, google messages (for rcs) and google fi. I'm not sure if theres anything close to the quality of traffic reporting as google maps, so it's hard to give up. The rest I will eventually move away from... Hopefully.

I have a home server with a reverse wireguard proxy for self hosting photos, calendars, etc.

I also have firefox with noscript blocking everything by default, but that's a big pain for an average person. Also it doesn't seem like firefox does a good job of anti-fingerprinting, but I haven't looked too deeply into that.

I even bought a tv that has adb access, and I removed a bunch of bloat, but it doesn't seem possible to remove the google launcher without causing huge system instability. I might just firewall it off.

There are a ton of open source alternatives to google products now, way more than the last time I tried moving away. It's time to leave.

It's alright, whatever the reasons might be, but let's not pretend there are no other ways out. I'm content with newest LineageOS on my 7 year old mid-range Xiaomi. I don't mind the loss of privacy guarantee. I don't have to spend any extra 350 euros and lose the headphone jack in the process.

So to avoid google's android I buy google phone to not run android?

What /new/ technology? The basically same platforms. Just smaller phones with more cameras recording everybody without consent.

> Convincing developers, especially bank and gov apps, is near impossible and won't scale well

Not impossible though, my bank and govt eID app did do safetynet, but after enough users complained in both apps you can now skip a warning and use it without issues

So it doesn't actually do anything to give control of the device back to the user?

One of the core tenets of truly free software is that I as user must be able to run, access, edit, and view everything.

Is anything bulletproof against the user signing away their data? I think the question was whether it has any measures in this regard, not whether it's impossible to get phished

How? I don't see the address published.

They can sue you and Google will give your address to the court, clearly. But swat? Send packages? How?

There's no such requirement for publishing a website

It's Android but without Google's services, there's an alternative app store.

The irony of Chinese vendors providing a breath of fresh low-DRM air.

Do you have any pointers on how to find the correct authority and reach out? I'd like to inform my EU audience.

I don't get what part of that your think enables them to deny access to third parties distributing their apps on alternate stores. If you're referring to the last paragraph, that very explicitly says that any such security must be an optional setting that is not default. So unless users opt into verified only apps, Google can't force that, according to the DMA.

An FDroid desktop client that adb installs APKs would actually be lovely. I pretty much exclusively use FDroid, but I gotta say I unfortunately find all their frontends to be rather buggy and with very little user feedback when things break (repo updates are hard to observe, downloads hang, updates mysteriously fail)

Ah so the Do No Evil wasn't serious after all?! /s

Not much one can do I fear...

Install f-droid and all kinds of 3rd part apps now.

Install GrapheneOS. (I'm guilty of not having that done that,yet :( )

Sign the petition (https://keepandroidopen.org/).

This started with phishing, poor people being tricked to install apps that then drained their bank accounts. So to resist, maybe focus on that evil? Better international cooperation, better prosecution?

Maybe we need an economic system where it is. Shame should come packaged with legal personhood.

Isn’t Google going to do what Apple has been doing since forever? Or is Google somehow doing something worse?

Installing via adb is not affected.

What's their interest in you building side-loaded apps instead of using their data hungry services?

There is a good solution. A big disclaimer and the user accepting the risk of running the software they want. The same solution they've been doing for years that did not need change. The new developer program is only here because it is more convenient to Google and governments.

You do need Google Play, or a suitable replacement, because most android apps won't work without it.

I have an old $70 test device with stock Android/Google that hasn't seen security updates in half a decade yet all banking apps, electric car charging, Google services, you name it, work absolutely fine.

Meanwhile the daily driver phones of my privacy-aware family members running up-to-date Lineage or Graphene OS with recent kernels and frequent updates constantly run into apps refusing to work for "security" reasons. It's a complete joke.

Google has been attempting to license the right to write.

There are a lot of poor people, mostly brown people, who do not have the ability to get one of these licenses.

Some of them are feeding themselves with their ability to write, and Google is literally stealing that food from their mouths.

Article got developer verification completely wrong. The point of developer verification is to be able to install apps outside the app store without warning, which brings Google Android builds in compliance with the antitrust ruling. Third party Android builds can choose other trust roots or disable ADV completely and require warnings for everything because they are not subject to the judgment.

Separately, the process of installing apps that are outside a system app store and aren't verified has also changed, but this is not required by the developer verification feature, and the result seems like a wash to me. The first time you enable installing apps from other sources is harder, but this setting then persists across device upgrades, so the subsequent times go away completely. This now requires developer mode, but apps that check developer mode (I haven't found any in the US) can be mollified with a Tasker task to disable developer mode when launching those apps and enable it again after.

> Google phones are surprisingly open and work well. Google takes a pro-user stance here that is extremely rare in the ecosystem, so why not support this product?

Because they will pull the rug here one day too. Why on earth should we trust them to keep this approach to their hardware?

Is there something we can do to support your efforts?

Problem is that all banks require a national centrale controlled service for login (BankID in Norway). And it is this service that I cannot get to work running GrapheneOS. It worked a couple of months ago, but not anymore. And all customer services and complaints are directed to your bank who 1) has no idea what i am talking about and 2) no control over BankID verification requirements.

It's even worse when Google believes they have a legally defensible justification that your data has been "anonymized". E.g. "anonymized" location data directly from your phone that just so happens to be accurate to the meter. Such data just cannot be anonymized.

At this point, the only "solution" is anti-compete legislation.

Because as designed they have to live under whatever google puts into Android because they have inordinate control over the whole ecosystem? I'm not sure why or how you would possibly describe that as "childish".

By analogy, would complaining about any organization ridiculously more powerful than you (e.g. a government) without having a complete alternative ready to go also be "childish"?

Most F-Droid apps are built from source. A link to Google Play may point to a newer version that has changed and could contain undesirable behavior.

It depends of the operating system you install. Fairphone by default comes with a pretty standard Android version with Google Play serices, so it will be impacted.

If you either buy a Fairphone from Murena (with /e/ OS) or from Iode (with Iode OS) or if you buy a standard one and install a version of Android without Google Play Services (like /e/ os or Iode), then you can still use FDroid.

I would in general recommend against getting a Fairphone. They traditionally have a lot of hardware issues. Some of the early issues on the FP6 (fried logic board while charging and broken volume button) are not user replaceable. Many people have had to wait a month before they get a reply from customer support and even longer to get their hardware fixed. They also completely fail to communicate about issues.

They also have a bad reputation when it comes to updating their software. E.g. their initial Android 15 builds for FP4 had bad memory management issues, with a result that many people could only have one app in memory at the time, which made it impossible to switch between e.g. an app/browser and a password manager/payment app. Some of their updates would cause boot loops when there were fingerprint reader issues, etc. Currently a lot of users are dealing with an issue where apps hang when used over WiFi because IPv6 gets misconfigured when a router sends an IPv6 router advertisement with lifetime 0 (which e.g. Fritz!Boxes that are popular in Europe do). The issue has been there for over three months without any acknowledgement or fix from Fairphone.

Also, even though they do Android Security Bulletins and major releases (though very late), their phones often run ancient kernels and firmware with many known vulnerabilities. This is also the case if you run an alternative OS, because pretty much all of them use upstream trees. Also their firmware has Chinese TCL image processing blobs (might be a security/privacy issue for some people).

I think many of these issues stem from the fact that the development of both the hardware and the software is largely outsourced to a Chinese ODM (T2Mobile), who maintain everything, so there is a lot of delay in everything. My guess is that Fairphone as a company is mostly a PR/support/supply chain auditing (as in minerals/labor, not software supply chain) company, with all the development outsourced.

In the PS3 case the feature was removed fully where in this case you just have to go through a new flow with warnings to reenable sideloading unverified developer's app.

Is that not already the case today? Everything on the play store is verified. Anything outside of that is not by google and you are shown something.

The whole point out of this outrage is alternative stores (like f-droid) can wholly and entirely be shut down on a whim without recourse.

I guess it becomes a part of Play Services.

I'm using a Librem 5 as my daily phone. PureOS is actively developed and based on Debian. Monthly development updates are published here: https://puri.sm/posts/tag/advanced-readers/

Personally, I do not use Android apps on the Librem 5, but Waydroid is available in the PureOS repository. Waydroid is a container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop environments (like PureOS).

PureOS also provides convergence via Phosh. Convergence means here that the same app can be used on a phone and on a big screen, the GUI adjusts to the available screen size.

Phosh aims to provide a daily-usable, robust and easy to use graphical user environment for mobile devices running mainline Linux. Phosh was originally initiated by developers from Purism for the Librem 5 phone but is nowadays used on many different devices covering smartphones, tablets and convertibles. It has even been seen on laptops.

There's also FuriOS with the FuriPhone.

That's debian based with gnome and seems to be built by capable people. Also, it can run android apps.

I really wish SailfishOS supported more hardware. I love sony phones, but the sony phone I love the most isn't supported despite being nearly identical to a supported one

Don’t know about US, but in EU you legally have to publish your address and it will be shown on the store page if your app has ads or in-app purchases.

You need to put a literal physical address and not even a PO Box is allowed.

It seems like China is becoming the "freedom superpower" while USA is getting "corporate superpower" vibes. Huh

Yes. From here: https://digital-markets-act.ec.europa.eu/contact-dma-team_en

Maybe not, but reading their blog posts about ADV next to the DMA text, that's certainly the angle they are trying. And it will be years if it ever comes to a court hearing.

And the setting is "optional", just do the 24h-waiting song and dance to change it, or use ADB. /s

I feel you about the frontends being buggy. Right now I've settled with Droid-ify[1] for doing my F-Droid browsing.

[1] https://droidify.app/

"Don't be evil" would be some evil company's motto in like Lego Movie 3

Wow, the link to the petition is buried halfway down the page. How is this not part of the first visible content?

or how about don't allow government and banks and telcos to use abusive apps to provide essential services?

those people fall for this because for everything poor people do, they need an app that is provided by sleazy vendors and that require tons of permission, and face scan and what not. they were primed so those business could save in operating costs.

that's the problem. won't solve it with slightly less sleazy vendors.

We can't even get India and Turkey sanctioned for evading the anti-Russian sanctions... good luck holding them accountable for the scam callcenters.

Better to pass state bills modifying all of that state’s articles of incorporation to compel adherence to B-corp standards.

I bought an android instead of an apple because I didn't want the kind of malware apple has always shipped with idevices

Their interests shouldn't matter. If they matter that much to restrict, then they are abusing monopoly power and need broken up.

Or buying some crappy app off the app store, from which they take a cut.

F-Droid apps do not need Google Play Services. OSMand (offline maps) and other apps works without it. Telegram probably should work too, but I did not test.

AI also says that it is possible to have push notifications without Google.

To pass MEETS_STRONG_INTEGRITY a device needs to have a security patch within the last year. Most apps don't check for storng integrity, though.

I think this argument isn't likely to go far, considering its use of a type of condemned speech (DEI). Part of the purpose of having ID verification for developers is to ensure that Google can provide information to the authorities so that developers can be held accountable for promoting such anti-government and terroristic ideology.

Careful about demanding that dystopia not discriminate against anyone. Because you just might get it, and it'll still be a dystopia.

Solutions from F-Droid? There are none. Like they said, it's an unremovable system service.

Usability-wise, they are no match for Android and iOS—or even versions of them from five years ago.

UI/UX is costly, and most FOSS projects cannot get it right without massive investments from enterprises (e.g., Red Hat's UX designers heavily contributed to GNOME) or startups (e.g., Zed, Element, Bluesky).

Projects without that backing are mostly unusable, at least from a Gen Z perspective.

And all are useless because you can't use your mandatory bank or gov id app.

All of which have beyond horrific security. GrapheneOS is the only acceptable alternative from mainstream Android.

Which phones are supported by which of these operating systems? And can you provide some relevant links?

There is - every server host does KYC and so does every domain registrar (by law). If you're found to have provided incorrect details, it allows them to immediately remove your server or domain without notice.

Partially true, HarmonyOS NEXT is its own thing, with a Typescript based language ArkTS.

https://developer.huawei.com/consumer/en/arkts/

And now they are adding yet another one, AOT compiled, Cangjie

https://cangjie-lang.cn/en

Using Android fork has been a transition step.

Low DRM? I looked at Huawei devices because I figured they'd have to sell them here super cheap because of this downside most Europeans people will even see as a showstopper ("how will I install my precious WhatsApp??"), but

- they're among the most expensive (I could afford that if needed though)

- they don't allow hardware unlock (ehh.. what's the point, then, if I get a locked-down device with Chinese surprises!)

It was indeed! And Google removed it in 2018.

- https://en.wikipedia.org/wiki/Don%27t_be_evil

> This started with phishing

It didn't.

Phishing is just a pretext. Google didn't care about Phishing for the first 20 years of Android. Why do they now? Because it serves as argument to close their platform a little more (which is a trend that has been going on for years).

Apple's policies were established when you purchased the phone. Apps come through registered developers and their vetting.

Google has changed the game on something you already own. I'm sure their lawyers have done their homework, but in some jurisdictions this is certainly actionable.

That's great but I want to be able to share such app with my family members coleagues

We've known for literally decades that that doesn't actually work, for several reasons:

1. People are conditioned to ignore warnings. There are way too many benign warnings in the world; you can't read them all.

2. Even when people wouldn't ignore them, in cases where they are being tricked by scammers it's easy for the scammer to talk people into accepting them.

3. Those sorts of warnings aren't actionable. You're installing a new app. It appears legit. You want to use it. You get a warning like "this app hasn't been verified; it might be malware!". What can you do with the information? Absolutely nothing. 99.9999% of users have zero way of doing any deeper check to see whether it actually is malware. Their only options are to give up and go home, or just hope that the warning is wrong. Even I - a highly technical user - get zero value from things like Windows' smart screen. "The app you're running hasn't been signed! It might be malware!". Err yeah sure. I'm not going to reverse engineer it to check am I?

I think their solution of allowing you to disable the restriction with a one-time one-day delay is actually a really reasonable solution. As long as they don't go further than that - the risk is that it is just a temporary placation and they'll ditch that option in a few years.

They do also sell the data-hungry side-loaded app builder.

Can I ask what you mean when you say "write"? Are you talking about literature / articles, or software?

This is new to me, want to stay on top of it.

That's only the consumer side of it though. As the post states:

> Should a developer[...] elect to register themself with Google as a “verified” developer, they should expect to sign up for an account and pay a fee, surrender detailed personal information and upload government-issued identification, and then proceed to register the identifiers and signing keys for all the apps they intend to distribute (now or ever).

Those are big impediments to open development. The agreement developers sign states:

> 6.5 If You violate any of the Terms or if You distribute malware or other harmful applications, Google may terminate Your access to the ADC…

But they don't actually define "malware" anywhere in the document. Search HN if you want to hear horror stories about how google handles loose definitions and peoples' accounts.

No there isn't, Google's requirement is to put that information publicly for everybody to see. That's not nearly the same thing as being available on court request.

With that policy, Google encourages stalkers and put developers in danger.

Neat, thanks for this correction! Interesting, an entire new programming language.

OK yeah I didn't know they stopped allowing to root. Normal levels of DRM then, my mistake, you're right.

and it is still there

https://abc.xyz/investor/board-and-governance/google-code-of...

I do think it's about Google trying to squeeze profits out of Android, but is there more direct evidence of this? Cause I always have to wonder if it's something else like KYC.

They could register as a corporate developer, but they decline to do so because _"that would effectively seize exclusive distribution rights to those applications."_ But it wouldn't - the course code is still available for anyone who wants to build and distribute the apps themselves.

I agree that the usability is behind, as we would expect. For me mainly is about missing apps and some hardware support. But in terms of UX for example I liked using SailfishOS, although I'll admit the UI needs some getting used to.

But I prefer this to the feeling that I'm being limited on what I can do on Android/Apple, and the worry of being in a duopoly that allows the companies to worsen their products without ever fearing competition(as far as they do it in small chunks).

FWIW, I use my smartphone as an MP3 player, SMS messenger and TOTP auth. iOS and Android did that fine 5 years ago, I don't need Instagram or 8 Ball Pool to survive in life.

Online banking is a thing. A heck of a lot more secure than an app on a certified android device passing play integrity but having last received security updates years ago and with a ton of privilege escalation exploits. Gov id? Just say no.

They already lost a lawsuit and were fined a hundred billion dollars in the EU for locking down Android. Maybe they think since they already lost once, they can't lose again.

Not useless. It is like the missing printer driver for Linux Desktop. It makes the experience ugly, but this is not the fault of the Linux OSes.

Also the bank should not require apps (instead they can offer hardware key support or desktop apps) and in fact some - at least in Germany - offer a different authentication possibility. Also the app for the German ID is published on fdroid and does not rely on Google services.

In my country, partially due to sanctions, you can access the bank via browser and receive 2FA codes on $15 dumb phone. Also why do you need bank app on your phone? Do you like to give money to random strangers on the street? Only scammers need money urgently. Also it is not secure to use the phone as a single factor to access the bank.

I do not have any bank apps on my phone (it is not even connected to the Internet) and I have no problem.

I oppose appdwang (although that can be hard, but until now I managed). Learn more about appdwang at https://appdwang.nl/ (in Dutch).

Might be worth trying to get your gov to pin down the number of users or process to get gov id supported on any new platform.

They likely wont specify 100k people or 10% of population or whatever email/petition but it at least records the requirement that other OSes exist and requires a process to support

This bogus "justification" for not considering any alternative, non-corporate mobile OS on any phone makes no sense

HN commenters will not let it go

Most HN readers have multiple computers, including multiple phones

There is no requirement that one has to run a closed-source banking or government ID app on the same phone as open-source apps, e.g., apps from F-Droid

And it ignores countless people who do not and will never use banking or government ID apps

I tested a banking app for depositing a paper cheque and it was incredibly convenient. At the same time, the app tried to make a plain, unencrypted HTTP connection to www.google.com

I blocked these connection attempts and the app still worked, with plenty of phoney error warnings. I would not be comfortable leaving one of these apps installed on a phone that's charged, powered on and has a cinnection to the internet

Every user is different but it makes no sense to argue on HN of all places that these closed-source banking apps are essential for everyone. Many HN users are never going to use these apps, and rightfully so

Except they're not useless because a lot of people aren't mandated to use any such apps. (And I feel sorry for those that are.)

It's a pity DivestOS has stopped.

- https://sailfishos.org - https://docs.sailfishos.org/Support/Supported_Devices

They have few devices of their own (new one coming out this October) and they officially support many Sony Xperia devices. There are also many community ports.

- https://ubuntu-touch.io - https://devices.ubuntu-touch.io

They have 33 supported devices, some are being shipped directly with the OS or have an official agreement with the phone maker, while others are community ports. Even if community ports, they all seem to have high hardware support, and is all very clearly documented.

- https://puri.sm/products/librem-5 / https://pureos.net

They focus just on the Librem 5, and not everything is fully working but as I said they prioritised privacy and FOSS. The phone is old but the OS is still in active development.

- https://postmarketos.org - https://wiki.postmarketos.org/wiki/Devices

They focus on supporting as many devices as possible, currently they don't have "main" devices they support, but they plan to. They too have a very clear documentation on features available for each device.

- https://mobian.org - https://wiki.debian.org/Mobian/Devices

They target devices made with the intent of running linux, but also have a few ports to android devices.

---

You'll notice that there are a few devices that are more "linux-friendly" and that are supported by many of these OSes. Phones from Pinephone and Fairphone being the main ones.

Hundred billion would be a quarter's revenue, that can't be right. The lasest I've read is a threat of a fine of around 500mil wrt app store issues back in December, but nothing has been decided yet.

hundred billion?

I switched banks and made sure it doesn't require Android/iOS. Many banks propose FIDO2 + SMS, even bank of america does.

Are they such new/fleeting friends that they can't wait 24 hours? Otherwise, it might be a good thing that people can't be persuaded to install an app because a "friend" told them to, and it's somehow so urgent that they can't wait 24 hours.

So install it via adb?

It's 2026. This technology has been out for how long?

We can't keep catering to the lowest common denominator of user. We have lost many computing freedoms over the decades as a result of this. Sorry, but its unacceptable.

If they really want such locked down experience to be the default, they could also just as easily put out a ROM everyone else can flash that has no restrictions. You still get to cater to the lowest common denominator but without taking freedoms away from anyone else that wants to keep them, with official support. No scammer is going to convince someone to plug their phone into their laptop and flash a new ROM in order to scam them. If they can, there's no protections that would have helped in the first place.

Sure, but the real profits to be had there, if any, are package deals with other megacorps, not hobbyists.

I think the commenter is alluding to writing software, as software is considered speech in some places.

We're moving to a world where it makes sense to have one cheap locked down phone with the society mandated garbage apps on it, and another device that you use for real computing.

I don't have a mandatory bank or gov id app. Where are you living?

Don’t they have standard Linux security? Does my phone need to be more secure than my production web server?

The problem is easy to solve by making 99% of all apps normal apps that don't get any special privileges and don't require any developer certification, and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps. It's not hard to attest unambiguously to the user in some way whether they are running one of these rare secure apps or a normal one, a restricted API suffices but you could also just add an LED for it.

You can't possibly convince me that Google couldn't develop something like that if they wanted to.

This is no different from before. If you want consumers to be able to install your app without a warning on Google builds, you have to jump through verification hoops. The only thing that ADV changes for developers is that now they can distribute their apps outside the system app stores without a warning as well, which is a new benefit, not a new restriction.

The correct thing to complain about is requiring developer mode for unverified installs, which doesn't seem necessary, not ADV. If you complain about ADV, of course the legislators are going to ignore you. ADV makes Google builds strictly more open and resolves the complaints of the state.

Good for Germans then. Slovenian banks won't let you use physical 2FA authenticators (for personal accounts and maybe even business ones at this point) anymore and will also require you to constantly update their stupid app (I've had to replace some otherwise good phones because the OS version wasn't supported anymore).

SailfishOS can run lots of banking apps with an Android emulation layer.

It's not perfect, but far from useless. Some use it as a daily driver.

Depending on your country, it can be super doable. There are also lots of indie native apps.

Does the F-Droid version of the app use hardware attestation?

Some banks require 2FA through their phone app to login to internet banking on the computer.

The question of how useful or not it is is orthogonal to whether it is the "fault" of Linux. Users who can't use it because something they need just doesn't work won't change their minds because the blame lies elsewhere.

I can do everything on my bank app from prepaying small amounts of a loan, spend analysis, opening fixed deposits and such.

App can work as digital money without card reader, maybe even free, like bitcoin.

> Also why do you need bank app on your phone?

Many banks gate features like mobile check deposit behind the native app. The nearest ATM is 20 minutes away from my house, so unfortunately I consider this feature essential.

In a town nearby me (not really near me but within an hour's driving distance), sometimes I will see old people selling fresh fruit/vegetables in their front yard. They typically take cash, Cashapp, or Venmo. It's super convenient to be able to use Venmo in that situation. These are people I haven't met before.

There are plenty of banks in Germany which offer over-the-counter services, if you prefer to do banking as if it's 1999. Most of the time, when people say it's impossible to live without a smartphone, it's actually only impossible to enjoy the conveniences of the internet without a smartphone (at least in Germany). Besides these rentable scooters, I can't think of anything that actually requires a smartphone. Sure, you'll miss out on a lot of conveniences, but I remember a time where that was the norm, so it's not like it's unreasonable.

In sweden it's not "mandatory" in the sense that it's illegal not to have it. It's just really really complicated to live without.

Many services won't work at all.

Linux security is quite bad. Android tries to improve this and GrapheneOS improves it even farther than that.

Which device you need to be more secure depends on your needs and which device you put sensitive data on, but a mobile device is going to provide far better privacy and security than any desktop hardware or OS is currently capable of.

>and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps.

How do you determine/enforce whether an app is a "payment app" without a centralized developer program? They don't require any special privileges. After all, most banking apps have web equivalents.

How does Android know if an apk that nobody has ever seen before is a payment or banking app?

You could probably restrict "risky" APIs like draw-over-other-apps, but tbh I think that would be a worse solution than just making people wait 24 hours once.

Oh man thank you for the clarification <3

How about saying no to these "mandates"?

Apparently much of Europe is a strange banking dystopia.

Perhaps the antiquity of the US banking system is finally coming in handy. I’ve still got my checkbook ready to go!

Yes!

But as a Plan B, why aren’t we emulating Android on these devices (or is it the Secure Enclave that’s the spicy bit that these apps need)?

I usually pay with cash. As a nice bonus, cash works even if there are mobile Internet shutdowns or blackouts and they cannot block the cash in your wallet unlike a bank account.

To add to the sibling comment, you are also ignoring the fact that in 1999 nobody had those conveniences, everybody was on equal ground. In 2026, if you handicap yourself by rejecting those "conveniences", you will be met by friction at every step - lower productivity at work, impatient looks from your family members etc.

Interesting, I never saw a bank check. The companies typically transfer money directly into the account, and there are P2P transfers by a phone number working between any major banks. So I guess.. I do not need this feature.

How often are you still receiving physical cheques that mobile deposit is an essential feature? I could probably count on one hand the number of cheques I've deposited or written in the past ~15 years, nor can I say I've been so desperate to access said money that I feel the need to deposit the cheque within moments of receiving it.

Carry a second cheap smartphone, like Pixel -a series or iPhone -SE. That one should be used for banking, government apps, for border inspections, etc. On your main GrapheneOS phone your financial app should be a Bitcoin wallet. The main phone should be off or in the BFU state when you are in a vulnerable situation.

The comparison to 1999 is not entirely accurate. It doesn't take into account that most physical banking locations closed down. At least here in Belgium for example, you have to go far to find one, and it's often on appointment only.

Android is going to bifurcate between "phones that run proprietary apps from the play store" and "phones that run software from anywhere else." And while maybe you can get by without banking apps, your life is going to get increasingly harder when you want to do many other things.

Ride hail app? Transit fare app? Government ID app? Airline app? Maybe you don't need them yet, but the best way to model this future is to consider what you'd do if you didn't have a phone at all, and the amount of friction this will generate as the expectations are only entrenched and expanded.

I'm glad people are saying no. It's good to do it as long as we can. But the final outcome seems inevitable now and to me it feels very close.

We aren't given the choice, in many cases. For example I remember a poster here who was forced to have an Android or Apple phone because his kids' school required an app to pick up the kids after school. So his options were to get a big tech phone, or get in trouble for not picking up his kids. "Get the school to come to their senses" was, unfortunately, not an option available to him.

I'm still living in the Netherlands without a bank app. It's occasionally less convenient, but quite doable.

Fortunately Google thought about this, so government ID and banking apps usually check that they are running on a sufficiently locked down and officially blessed phone through the Play Integrity API.

This makes emulation basically impossible.

Two cases when I've received a bank check without being able to choose an alternative: 1) as payment of proceeds in a class-action lawsuit; 2) when I got a refund from my insurance provider after changing the terms.

These might not be very common, but they're still not really rare in society either.

Checks are still common in the good ole USA.

At least 3 times a month. I have a rental property and my tenant prefers to mail a check instead of paying extra to pay electronically. My spouse gets paid by check for dumb reasons I won't get into. I sometimes get dividends from my insurance company via check. And then several family members still prefer to use checks to pay each other back instead of Venmo or other electronic services.

I blame it on the fact that the US doesn't have a free electronic bank transfer system like the rest of the developed world.

I've been using several GNU/Linux smartphones as my only phones for the past 18 years (with a short exception around 10 years ago when I carried an Android phone too as there was a gap on the market) so I can say from first-hand experience that it's really not such a big deal as everyone keeps painting it. For these kinds of odd needs where you have no hope to fight back you just launch Waydroid, use the app and stop the container afterwards. However, when you do fight back it often turns out that this "mandatory app" isn't actually so mandatory and in turn you contribute to making the world around you a bit better.

I'm living in Poland and the only thing my bank's application gives me that its website doesn't are mobile TOTP-based payments - and even then it just works in Waydroid, so I can still use it on a GNU/Linux phone if I want to.

Common? maybe for seniors. I probably handle a physical check once a year.