upvote

points

by anonymousiam16 hours ago |
comments
upvoteby binarin12 hours ago|
next
[-]
The most hilarious is McDonald's app - it refuses to work without Play Integrity check. I wonder what braindamaged reasoning is behind this. Do they want to position themselves as a bank or something?
reply
upvoteby QuantumGood2 hours ago|
parent|
next
[-]
Also on the homepage: "Volkswagen started blocking GrapheneOS users"

  https://news.ycombinator.com/item?id=48571526
reply
upvoteby bhelkey2 hours ago|
parent|
prev|
next
[-]
Fastfood apps typically offer deals to new customers.

I suspect this is an attempt to prevent folks from spinning up many new accounts to get these deals.

reply
upvoteby pona-a9 hours ago|
parent|
prev|
next
[-]
I recall a year or so ago, there's been a story about someone hacking McDonalds loyalty program, with that app doing something stupid like storing your balance on the client or something. It seems instead of firing whatever offshore sweatshop that made that, they just doubled down on "mitigations".
reply
upvoteby mtlynch4 hours ago|
parent|
next
[-]
Was it this it this one by Eaton Works?

https://news.ycombinator.com/item?id=42462354

reply
upvoteby throawayonthe6 hours ago|
parent|
prev|
[-]
the app actually did the play integrity thing long before that :P
reply
upvoteby drnick12 hours ago|
parent|
prev|
next
[-]
What would anyone use an app to order food from McDonald's? Just walk into the restaurant, pay cash, and walk out with the food.
reply
upvoteby bhelkey2 hours ago|
parent|
[-]
McDonald's app (other other similar apps) offer discounts to ordering through their app.

For example, McDonald's has a long running campaign, 99¢ for coffee. Any size, iced or hot.

reply
upvoteby domh12 hours ago|
parent|
prev|
[-]
Huh, it works just fine in the UK. Wonder if they have different builds (or completely different apps) for different regions. Or maybe it's the GrapheneOS compatibility layer that makes it work? Not sure.
reply
upvoteby pona-a9 hours ago|
parent|
[-]
Play Integrity has several levels. GrapheneOS MEETS_BASIC_INTEGRITY, which I believe only requires a locked bootloader and no superuser.

There's also been some discussion of spoofing MEETS_DEVICE_INTEGRITY, since before Android 13 it didn't rely on a TPM, and many apps don't want to lock out older devices, but it's been decided against it [0].

[0] https://github.com/GrapheneOS/os-issue-tracker/issues/1986

reply
upvoteby anonymousiam2 hours ago|
parent|
next
[-]
I saw on the GrapheneOS forums that some people had managed to get it working, but I was unable to do so.

My bootloader is locked, because I re-locked it after installing GrapheneOS. The app runs, but refuses to let me log in. I even tried (temporarily) using a browser to login, and let the browser switch to the app in the process. Nada.

It's ridiculous that Google bills their "DEVICE INTEGRITY" initiative as a security feature, when GrapheneOS, which is a more secure platform, cannot use it.

reply
upvoteby x79p12gz2 hours ago|
parent|
prev|
[-]
Hmmmm.... Actually you can have an unlocked bootloader for the basic integrity level.[0]

[0] https://developer.android.com/google/play/integrity/verdicts

reply
upvoteby drnick12 hours ago|
prev|
next
[-]
"Strava is an American internet service for tracking physical exercise which incorporates social networking features."

Sounds like spyware, to be honest.

reply
upvoteby haltcatchfire7 hours ago|
prev|
next
[-]
I run Strava on my Pixel 10 Pro Fold running GrapheneOS. IIRC you need to have Google Play Store installed (with zero permissions, preferably) to make Strava work.
reply
upvoteby anonymousiam2 hours ago|
parent|
[-]
Both Google Play Store and Google Play Services are installed, with minimal permissions. Strava still does not work.
reply
upvoteby flaburgan7 hours ago|
prev|
[-]
I know a friend is using Strava on his Pixel 10 running graphene so there should be a way
reply
upvoteby anonymousiam2 hours ago|
parent|
[-]
There should be a way, but I have not yet found it, and I've spent some time on this. I've installed/uninstalled Strava about a dozen times, rebooted each time, tried various permissions, but stood my ground on some of the permissions. Should I give Strava access to my photos and my microphone? I'll never go that far.
reply