GrapheneOS attacca Revolut dopo il blocco: “Non lo fa per sicurezza. Funziona su Android 9 che non ha patch dal 2018”

The tension between banking platforms and alternative operating systems reaches a new peak with the recent head-on clash between GrapheneOS and Revolut.

The privacy-focused Android project launched a strong offensive against the fintech company, accusing it of deliberately blocking its own users through unfounded pretexts.

According to the developers of the operating system, the recent difficulties in accessing the application do not stem from real concerns about data protection, but from the intent to impose Google Play licenses, while at the same time ignoring the most basic cybersecurity standards.

GrapheneOS vs Revolut: the accusations of negligence and the contradictions

GrapheneOS points out how the security-related justifications are completely inconsistent if one considers that the Revolut app continues to support devices based on Android 9. This is an operating system lacking security patches for more than 8 years.

For this reason, the developers have described the company as incredibly negligent, highlighting how their security standards are effectively non-existent. The integration of numerous “closed-source third-party libraries that pose privacy, security, and compatibility issues“.

The dispute is not entirely new, since as early as January there had been attempts to restrict, temporarily circumvented by the GrapheneOS team. Now, reports of login problems are increasing again, affecting especially new logins, while those who had already logged in previously seem to suffer fewer issues.

The accusations go so far as to outline a real and outright attack.

Revolut would actively seek specific indicators to identify and ban GrapheneOS software. For example, the operating system notes how the app blocks the verified boot state “yellow”, i.e., the one protected by non-original keys, but paradoxically allows the “orange” one, related to devices that are fully unlocked and therefore less secure.

If hardware protection were the real priority, developers emphasize, Revolut could constructively leverage the Android Attestation APIs, for which they have provided technical documentation for years without ever receiving any response.

Il confronto con gli altri istituti e le contromisure

While several traditional banking institutions are starting to explicitly authorize the use of GrapheneOS in addition to Google-certified systems, the British fintech appears to be moving in the opposite direction.

Applications that use Play Integrity usually don’t go so far as to disparage GrapheneOS security, making Revolut’s stance a rather notable exception.

For users currently affected by the block, there is still a provisional workaround that requires access to a secondary Google account and installation via the sandboxed Play Store, in order to bypass the initial checks. The OS developer company is nevertheless working on a definitive solution to overcome installer blocks.

Contacted regarding these heavy statements, Revolut has avoided commenting on the individual accusations raised on X, limiting itself to issuing a statement in which it reiterates full support for the standard Android and iOS platforms.