7 ms·

The most hilarious is McDonald's app - it refuses to work without Play Integrity check. I wonder what braindamaged reasoning is behind this. Do they want to pos

by binarin 3mo ago

The most hilarious is McDonald's app - it refuses to work without Play Integrity check. I wonder what braindamaged reasoning is behind this. Do they want to position themselves as a bank or something?

domh 3mo ago
Huh, it works just fine in the UK. Wonder if they have different builds (or completely different apps) for different regions. Or maybe it's the GrapheneOS compatibility layer that makes it work? Not sure.
- pona-a 3mo ago
  Play Integrity has several levels. GrapheneOS MEETS_BASIC_INTEGRITY, which I believe only requires a locked bootloader and no superuser. There's also been some discussion of spoofing MEETS_DEVICE_INTEGRITY, since before Android 13 it didn't rely on a TPM, and many apps don't want to lock out older devices, but it's been decided against it [0]. [0] https://github.com/GrapheneOS/os-issue-tracker/issues/1986 https://github.com/GrapheneOS/os-issue-tracker/issues/1986
  - anonymousiam 3mo ago
    I saw on the GrapheneOS forums that some people had managed to get it working, but I was unable to do so. My bootloader is locked, because I re-locked it after installing GrapheneOS. The app runs, but refuses to let me log in. I even tried (temporarily) using a browser to login, and let the browser switch to the app in the process. Nada. It's ridiculous that Google bills their "DEVICE INTEGRITY" initiative as a security feature, when GrapheneOS, which is a more secure platform, cannot use it.
  - x79p12gz 3mo ago
    Hmmmm.... Actually you can have an unlocked bootloader for the basic integrity level.[0] [0] https://developer.android.com/google/play/integrity/verdicts https://developer.android.com/google/play/integrity/verdicts
pona-a 3mo ago
I recall a year or so ago, there's been a story about someone hacking McDonalds loyalty program, with that app doing something stupid like storing your balance on the client or something. It seems instead of firing whatever offshore sweatshop that made that, they just doubled down on "mitigations".
- throawayonthe 3mo ago
  the app actually did the play integrity thing long before that :P
- mtlynch 3mo ago
  Was it this it this one by Eaton Works? https://news.ycombinator.com/item?id=42462354 https://news.ycombinator.com/item?id=42462354
drnick1 3mo ago
What would anyone use an app to order food from McDonald's? Just walk into the restaurant, pay cash, and walk out with the food.
- bhelkey 3mo ago
  McDonald's app (other other similar apps) offer discounts to ordering through their app. For example, McDonald's has a long running campaign, 99¢ for coffee. Any size, iced or hot.
bhelkey 3mo ago
Fastfood apps typically offer deals to new customers. I suspect this is an attempt to prevent folks from spinning up many new accounts to get these deals.
QuantumGood 3mo ago
Also on the homepage: "Volkswagen started blocking GrapheneOS users" https://news.ycombinator.com/item?id=48571526

by binarin 3mo ago

domh 3mo ago

Huh, it works just fine in the UK. Wonder if they have different builds (or completely different apps) for different regions. Or maybe it's the GrapheneOS compatibility layer that makes it work? Not sure.

pona-a 3mo ago
Play Integrity has several levels. GrapheneOS MEETS_BASIC_INTEGRITY, which I believe only requires a locked bootloader and no superuser. There's also been some discussion of spoofing MEETS_DEVICE_INTEGRITY, since before Android 13 it didn't rely on a TPM, and many apps don't want to lock out older devices, but it's been decided against it [0]. [0] https://github.com/GrapheneOS/os-issue-tracker/issues/1986 https://github.com/GrapheneOS/os-issue-tracker/issues/1986
- anonymousiam 3mo ago
  I saw on the GrapheneOS forums that some people had managed to get it working, but I was unable to do so. My bootloader is locked, because I re-locked it after installing GrapheneOS. The app runs, but refuses to let me log in. I even tried (temporarily) using a browser to login, and let the browser switch to the app in the process. Nada. It's ridiculous that Google bills their "DEVICE INTEGRITY" initiative as a security feature, when GrapheneOS, which is a more secure platform, cannot use it.
- x79p12gz 3mo ago
  Hmmmm.... Actually you can have an unlocked bootloader for the basic integrity level.[0] [0] https://developer.android.com/google/play/integrity/verdicts https://developer.android.com/google/play/integrity/verdicts

pona-a 3mo ago

I recall a year or so ago, there's been a story about someone hacking McDonalds loyalty program, with that app doing something stupid like storing your balance on the client or something. It seems instead of firing whatever offshore sweatshop that made that, they just doubled down on "mitigations".

throawayonthe 3mo ago
the app actually did the play integrity thing long before that :P
mtlynch 3mo ago
Was it this it this one by Eaton Works? https://news.ycombinator.com/item?id=42462354 https://news.ycombinator.com/item?id=42462354

drnick1 3mo ago

What would anyone use an app to order food from McDonald's? Just walk into the restaurant, pay cash, and walk out with the food.

bhelkey 3mo ago
McDonald's app (other other similar apps) offer discounts to ordering through their app. For example, McDonald's has a long running campaign, 99¢ for coffee. Any size, iced or hot.

bhelkey 3mo ago

Fastfood apps typically offer deals to new customers. I suspect this is an attempt to prevent folks from spinning up many new accounts to get these deals.

QuantumGood 3mo ago

Also on the homepage: "Volkswagen started blocking GrapheneOS users" https://news.ycombinator.com/item?id=48571526