orange

joined 7 months ago
[–] orange@communick.news 2 points 2 weeks ago (1 children)

No, Play Integrity intentionally checks if it's a Google-approved key. Android itself has an API to check verified boot and gives info on the signing key - most devs just want to know verified boot is working.

I feel Play Integrity has a short life ahead of if competition authorities realise how exactly it works. "Anti-competitive" is the first thing policy-minded folks think when I explain the API to them.

[–] orange@communick.news 14 points 2 weeks ago (5 children)

For GrapheneOS, it's primarily that it's re-lockable. That's why other unlockable phones aren't supported.

The GrapheneOS install process sets new OS signing keys so you can lock the phone again and get full verified boot. However, most manufacturers haven't implemented this feature.

[–] orange@communick.news 12 points 2 months ago* (last edited 2 months ago)

I think it might be confusion between inspecting plaintext metadata like SNI vs actually inspecting encrypted contents (e.g. HTTPS content, headers, etc.).