Who decides whether your phone is secure enough? CodeB Wallet on GrapheneOS
An identity wallet has to know that the phone it runs on has not been tampered with. Many apps hand that question to Google’s Play Integrity, a service of Google Play. The result: phones with an alternative system such as GrapheneOS fail the check – not because they are insecure, but because Google does not approve them. CodeB Wallet takes a different path.
Who decides – Google or the phone?
- 1Your phoneA Pixel with GrapheneOS, or a phone with Android
- 2Secure hardwareThe phone’s chip vouches for the wallet’s keys
- 3Locked and verifiedBootloader locked, system verified at start
- 4AcceptedNo Google Play needed
Every EU Digital Identity Wallet must make sure the phone has not been rooted or modified, otherwise the identity keys would not be safe. The convenient default for app developers is Google’s Play Integrity: Google looks at the phone and says yes or no.
That works for most phones, but it makes Google the gatekeeper for a European identity. GrapheneOS – a hardened Android system for Pixel phones, widely used by people who care about security and privacy – does not get a “yes”, so wallets built this way simply refuse it.
How CodeB Wallet checks your phone
CodeB Wallet asks the phone’s secure hardware instead. The chip that holds the wallet’s keys confirms that the keys were made inside it, that the bootloader is locked and that the system was verified at start. That is part of Android itself – it needs no Google Play.
Where Play Integrity is available, it is an extra signal. Where it is missing or says no – as on GrapheneOS – the hardware decides. For GrapheneOS we recognise the official signing keys of the system, so a Pixel 6 or newer with GrapheneOS and a locked bootloader is accepted.
What stays out
Sovereignty is no reason to lower security. Phones with an unlocked bootloader or root access are refused, whatever system they run – on such phones nobody can be sure that the identity keys are protected. Other Android systems need a locked bootloader with verified boot as well.
Independent from Google? Honestly: from Google Play
The hardware check is part of Android, and its chain of certificates ends at a Google root – on Android, nobody is completely independent of Google. What we do avoid is depending on Google Play and on an approval list that Google keeps. Which systems CodeB Wallet accepts is our decision.
Digital sovereignty starts with decisions like this one.
Using GrapheneOS? Try CodeB Wallet
- Use a Pixel 6 or newer with GrapheneOS and keep the bootloader locked.
- Install Google Play in GrapheneOS’s sandbox (GrapheneOS App Store) – the beta is distributed through Google Play.
- Join the beta with the Google account you use in that sandbox.
- Tell us how it works for you: info@aloaha.com.
Built to the rules
CodeB Wallet is built to the EUDI Wallet Architecture and Reference Framework – certification is ahead of us. Made in Malta.
Questions about GrapheneOS
Does CodeB Wallet work on GrapheneOS?
Yes – on Pixel phones from the Pixel 6 onwards, with the bootloader locked. The phone is checked through its secure hardware, so Google’s Play Integrity is not needed.
Do I need Google Play?
Not for the security check. To get the beta, you install Google Play in GrapheneOS’s sandbox and join with that Google account.
What about LineageOS and other systems?
CodeB Wallet needs a locked bootloader with verified boot. Systems that run with an unlocked bootloader – as LineageOS does on most phones – are refused, to protect your identity.
Is the wallet then completely independent of Google?
No. The hardware check is part of Android and its certificates end at a Google root. CodeB Wallet does not depend on Google Play or on Google’s approval of your system.
Why do some EU identity wallet apps refuse GrapheneOS?
Because they use Google’s Play Integrity to decide whether a phone is trustworthy, and Play Integrity does not approve systems Google has not certified – even hardened ones like GrapheneOS. It says nothing about how secure the phone actually is.
Which Pixel phones work?
Pixel 6 and newer with GrapheneOS installed and the bootloader locked again after installation, as GrapheneOS’s installer recommends.