For Google control is the issue (and the data flowing with it), not security, and once again we in Europe just swallow that shit and mess up our supposed "open" standards. In this case it really is because there are no competent people making these decisions. They just trust Google when they say: "It's for security".

I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the U and throwing privacy conscious user under the bus.

> It's not, it's more about sovereignty and control

The bank doesn't care about either. It cares about the risks, costs and opinion of the regulator on how well it evaluates and controls those risks.

If risks can be transferred to an external party and DNB signs on it, sure. If DNB says reliance on this specific external party is a risk in itself, then sure, there will be a plan for that too. The plan could be "if google becomes a problem we can publish a new version of the app using grapheneos attestation anchors in N weeks"

Of course they pass system integrity. The whole point of the thing is not "it should be secure", it's "the user has not messed with it so we control it".

Well, yes? The law says that the bank should do the thing and the bank does the thing to the best of it's ability, given what people usually work there.

> the bank does the thing to the best of it's ability

No they don't. At best, they do a cost-effective proxy for what should be done.

Oh, you have no idea. It's not even about costs. In a 200 year old company the level of corporate disfunction and the average skill level of people is something else entirely. Nothing ever happens unless the regulator holds a blowtorch wired to a timer to the CEO's ass.

If the device is "insecure", doesn't that mean you - as a user - can exploit one of those insecurities to "mess with" the device without system integrity being aware?

Or are you saying the device is insecure BUT has no local privilege escalations you can take advantage of as a user?

It could have RCE but not privilige escalation. But I don't buy it, because 5 years without kernel patches is at least 5 escalation exploits being written by the an llm in 5 minutes

It means the spyware information flow and Google's ability to remotely modify the device have not been disabled.