Revolut is blocking new logins from Android distributions that aren't certified by Google, incl. GrapheneOS

Privacy
21

I think I’ll have to disagree.

From my perspective it is Google’s Fault for making and marketing Play Integrity API as a Security API.

As pointed out by someone who I had a agree to disagree conversation. This is indeed Google’s fault. If google was honest or implemented in a way where it does support custom ROMs this wouldn’t be a problem but they intentionally don’t, Unless they have fixed it, Play Integrity API apparently passes even with an 8 year old EOL Phone or something which is crazy when GOS is really more secure.

I do not in any way Blame revolut in this situation, They just took Google’s word without realizing the implications as such.

So Google takes most of the blame than Revolut.

I hope we can agree to disagree from here.

22

Look, I am not arguing GOS is more secure. However Integrity API does prevent running from emulators.

Doesn’t mean it doesn’t have side effects

1 Like
23

Malice or ill-intent isn’t required for an act to be illegal. Using the Play Integrity API artificially prevents other platforms like GrapheneOS, which maintain Android app compatibility, from fairly competing with Google’s certified Android. That is the textbook definition of anti-competitive.

I think you give Revolut too little credit, they aren’t stupid, they have competent cyber-sec people who should understand that Play Integrity is pure bs.

So does hardware attestation. And Play Integrity is easily bypassed to run in an emulator or wherever you want since you can pretend to be an old insecure device.

2 Likes
24

Screenshot_20241209-131145
Screenshot_20241209-131145864×1920 185 KB

Screenshot_20241209-131140
Screenshot_20241209-131140864×1920 191 KB

Screenshot_20241209-131157
Screenshot_20241209-131157864×1920 168 KB

25

I wouldn’t hold my breath, these messages sound a lot like they were written by a LLM…

26

I firmly believe that they were. It doesn’t seem to me that there is a single human word there.

27

after the request to speak to a human there were not LLM

28

Play integrity API will require devices to have had at least one update in the last year FYI
It sucks that it prevents GrapheneOS users to run apps, but it’s no longer a security theater

29

Yup, an LLM would not say GrapheneOS is an emulator lol.
Crazy we now recognize humans with their weaknesses rather than strength.

30

Customer support is usually clueless about this, that’s why they tend to mistake it that way. (what they could’ve done is obviously escalate from customer support to technical customer
support). The agent on the other line probably really had no idea about it until it was said correctly. It happens and if I was in their case would probably be at the same conclusion if I was that clueless. As I said before it wasn’t escalated to Technical which they should have so that seems as expected.

I also wish they gave the timestamps to confirm but they did not so.

Edit 2: If you want to treat it as playing devil’s advocate here that’s fine by me

1 Like
31

They did but I blurred them as my timezone is a bit private, would prefer not to be known.

1 Like
32

I dont have any. :disappointed_relieved:
But all i can do is fund the account when I need it and then take my money out after, use it until it dies :person_shrugging:

33

Prob. try Wise?

No single use card but you can hold 3 virtual cards at the same time, you can also delete and create new ones.

Its not a bank though.

2 Likes
34

Is it possible to use the webapp ?
It could be a solution if it works.

35

Unfortunately (and as of the time I tried it before which I think is like 1-2 years ago)
The web app is super basic it can’t be a replacement of the app

36

I tried, you can’t even pay with the web app unless I am blind.

1 Like
37

well wdym by pay?

38

I’m not sure how one update in a year has any bearing on the security of the device. The only way to run a remotely secure version of Android is to be on the latest Android version. There is no LTS branch, and only patches for the most severe vulnerabilities are ever backported. A device running Android 13 with a security update from the past year is not and should not be considered secure.

Regardless, the security argument falls apart completely because if Google / app developers actually cared about security, they would allow GrapheneOS to pass their checks.

Google post on Play Integrity API changes

2 Likes
39

I could see my transactions through the web app, but I couldn’t find a way to actually send money to a friend or to a bank account. I could however use the virtual card details for filling online payment forms, but that is not the primary use of Revolut in my case.

40

You need to confirmcnnection from Android app to login into their webapp. And yup, very, barebone.

Do you have a source for that? Becauss I will assume Play Integrity relies on some encrypted key to verify the authenticity of the OS, otherwise it would be totally useless