Conversation

Pepijn de Alpaca
@pepijndevos
Wow what the hell??? Apparently Android apps include some form of DRM based on some Google ID baked deep into Google sanctioned ROMs?? Making it impossible to run even open source apps like Signal on phones without it.
Quote Tweet
Joshua 绿色 AKA Packed Knightley
@Elvenmonk
Replying to @pepijndevos
Most custom roms, or phones sold in the west, have those tool sets without realizing it. Only phones affected by the US embargo, and ones sold where Google is banned, have 0 Google kernel access.
3
6
Daniel Micay
@DanielMicay
Replying to
@pepijndevos
and
@f4grx
No, they don't. Signal explicitly chooses to use the Play services libraries. Android SDK is open source, can be built from source and doesn't include those by default. Using the Play services libraries doesn't impose any kind of DRM on the app. There's no basis to any of this.
1
5
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@pepijndevos
and
@f4grx
The only thing remotely resembling what's described is that an app developer can explicitly choose to use the SafetyNet attestation API as part of a service provided to the app to check that the device has been CTS certified. App developer has to go far out of the way to do it.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@pepijndevos
and
@f4grx
SafetyNet isn't based on any ID. It has a software implementation checking for the device / OS appearing to be a combination that's certified, and a hardware implementation based on a batch certificate provisioned on 100k+ devices. It has to be very explicitly used by a service.
1