Volkswagen blocks custom ROM users from VW app | heise online

heise+ entdecken

SuchenAbo

Suchen

Alle Magazine im Browser lesen<br>AnzeigeSpecial: Collaboration im KI-Zeitalter

Newsletter<br>heise-Bot<br>Push-Nachrichten

${lead}

${lead}

${content}

${content}

${content}

${content}

Anzeige<br>Special: Collaboration im KI-Zeitalter

Advertisement

Advertisement

Drivers of cars from the Volkswagen Group using alternative Android versions like GrapheneOS, LineageOS, or /e/OS have been unable to use the VW app for some time. This means they can neither check their vehicle's remaining range from their phone, schedule service appointments, nor control charging and air conditioning. The car manufacturer has made changes to the app's backend that only allow devices with Google's pre-installed Play Services. When asked by heise online, VW stated that affected users should not expect a timely reopening. “However, they are looking into it.”

Continue after ad

No Play Services, no VW app

As Volkswagen explains to heise online, the blocking of custom ROMs is related to a restructuring of the software architecture. To use the app on Android devices, Google's Play Integrity API (formerly known as SafetyNet) is required, which is only available on Android devices with Google's Play Services.

According to Google, the interface is used to ensure that the device's integrity is not compromised. Alternative custom ROMs, which developers deliberately keep free of Google services, are therefore excluded. Numerous users of third-party services like “Home Assistant Volkswagen Carnet” or the control software EVCC may find this familiar. The company has, overnight, cut off access to a programming interface that allowed them to query the battery's charge status or optimize the charging of the wallbox in their apps.

Criticism from the Custom ROM Front

Google's Integrity interface is sharply criticized by GrapheneOS and others. GrapheneOS recently wrote on X about the Integrity API, stating that Google misleads companies regarding the functions of the Play Integrity API. The interface “doesn't genuinely enforce having a secure device or legitimate app, it only pretends to. It leaves huge security holes open. It enforces Google's business interests and bans having a reasonably secure device with GrapheneOS” and other custom ROMs. Instead of Google's proprietary solution, the custom ROM developers propose hardware attestation.

A consortium including custom ROM developers Volla, Murena (which develops the custom ROM /e/OS), Iodé from France, and Apostrophy from Switzerland is also working on an alternative to Google's API, as it creates “a structural dependency” – and represents a de facto exclusion criterion for alternative operating systems. As an alternative, they are working on a so-called “UnifiedAttestation” for Google-free mobile operating systems, which should also enable attestation. The consortium's primary goal with its solution is to enable banking apps on custom ROMs.

Continue after ad

Hyundai and Kia with GrapheneOS Support

While VW is locking out users with custom ROMs, Hyundai shows that vehicle apps can also be used with alternative Android versions. The myHyundai app also supports GrapheneOS.

Videos by heise

mehr Videos

c't 3003

heise & ct

Peertube

Volkswagen told heise online that they are looking into it, but for now, they cannot offer the VW app for Android alternatives. Meanwhile, the app can still be installed on very old devices running Android version 10 or newer, which have not received security updates for years.

Mehr anzeigenWeniger anzeigen

(afl)

Don't miss any news – follow us on<br>Facebook,<br>LinkedIn or<br>Mastodon.

This article was originally published in

German.

It was translated with technical assistance and editorially reviewed before publication.

Dieser Link ist leider nicht mehr gültig.

Links zu verschenkten Artikeln werden ungültig,<br>wenn diese älter als 7 Tage sind oder zu oft aufgerufen wurden.

Sie benötigen ein heise+ Paket, um diesen Artikel zu lesen. Jetzt eine Woche unverbindlich testen – ohne Verpflichtung!

Wochenpass bestellen

Sie haben heise+ bereits abonniert?

Hier anmelden.

Oder benötigen Sie

mehr Informationen zum heise+ Abo

Anzeige

Advertisement

Warum Open-Ear-Kopfhörer mehr sind als Technik

Wenn die KI ein Handwerker-Angebot erstellt

Zu viele Endpoints, zu wenig Überblick?

Sicher verschlüsselte E-Mails aus Deutschland

IT-Störungen proaktiv erkennen

Wann sich ein wirkungsvoller Solarspeicher lohnt

Wie KI den Beschäftigten im Krankenhaus hilft

Themenspecial: Collaboration im KI-Zeitalter

Braucht eine IT-Abteilung wirklich 15 Tools?

Warum Online-Marketing für Firmen wichtig ist

Shortlink:

https://heise.de/-11370557

Advertisement

Advertisement

Newsletter

heise-Bot

heise-Bot

Push Nachrichten

Push

Push-Nachrichten

kopieren