GrapheneOS still maintains the OS security model including the application security model. It has nothing to do with what you claim.
Don't need to be have it explained why you think things are designed the way they are as someone deeply involved in implementing these things.
Conversation
If you don't want that security model, nothing stops you from turning on debug mode for an app, signing it with your key and installing it. You don't need to do that to backup and restore data unless the app excludes it from backups. A debug build of either OS or app bypasses it.
1
Google Android isn't iOS. It doesn't stop you from easily installing whatever software you want including modified proprietary apps. It's trivial to change the debugging flag and sign the app with your own key. OS doesn't help them obfuscate their code, etc. in any way either.
1
This Tweet was deleted by the Tweet author. Learn more
Google doesn't make the hardware or operating system for any Android devices with a permanently locked bootloader. I never said you had to do what I suggested for every app update and you obviously wouldn't be doing it by hand. It's trivial to change debug flag and sign an app.
1
This Tweet was deleted by the Tweet author. Learn more
You don't lose the advantages of app signing. The signature of the app gets verified, then it gets signed with a different key. You lose the advantages of verified boot which you clearly don't want anyway since that's completely incompatible with what you want.
1
There's a large community of users making use of modded variants of proprietary apps. I have no interest in that but the OS certainly doesn't stop you from doing it. The only thing Android provides which hinders that is hardware-based key attestation via the hardware keystore.
1
Play (not Android itself) also has a terrible primarily software-based attestation API but that's easily bypassed at this point. Anyway, nothing stops app developers depending on attestation for other OSes either. Existed before either Android or Play had an API for doing it.
1
GrapheneOS doesn't have Play services so that API isn't relevant and it's highly unlikely that any app would actually use hardware-based attestation to lock itself down on GrapheneOS. They probably wouldn't be whitelisting the GrapheneOS verified boot key in the first place.
1
But sure, if some bank wants to whitelist our verified boot key for hardware-based attestation we support that and we uphold the security model. More than happy to have that choice available to users, as opposed to the app not being available. If you don't want it, don't use it.