Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by ledoge on Friday November 06, 2026 @08:56AM (#50392334)

I don't think the attack can work as described here. One of the features that GrapheneOS lists is:

> Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)

From my understanding, this means that even if you do have the signing keys, you cannot install an update that would remove the need for knowing the screen lock to unlock the filesystem's encryption - as installing such an update requires entering the screen lock first.

[ Parent | on HN ]

Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by Gander5739 on Friday November 06, 2026 @09:48AM (#50392968)

To my knowledge this is true for normal android as well (perhaps not that authentication is required); the data is encrypted against the passcode.

[ Parent | on HN ]

Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by microtonal on Friday November 06, 2026 @11:49AM (#50394846)

But the phones were also under some form of MDM, maybe they could have used that?

[ Parent | on HN ]

Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by buzer on Friday November 06, 2026 @01:45PM (#50396541)

However if you have signing keys and access to the update delivery infra you could just publish the update and wait for it to get auto updated before starting to seize the phones.

[ Parent | on HN ]