I use GrapheneOS, but if you as a bank want to gate access to my money via some kind of technology, you better be including it as part of the account.
For example, HSBC continues to let me manage my bank account via the web browser, and continues to offer a battery powered hardware token as the means of authentication.
I let you hold my money, for whatever reason. Why do you expect me to be your distributed infrastructure provider? I am not going to let you require that I run your proprietary malware in order to access my own money.
The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.
I'd say that JS webapps are the same but at least there you run things on your terms in a sandbox that you can inspect and look at the requests, and there's no effective enclave carved out of your hardware (except for EME but that's another topic for another day and I'd be complaining if banks started to use it too).
You might be overthinking it. Most people want to use their phone for convenience, and if an app allows them to remove just one step in their banking activities, they'll probably do that.
As for the second part (separate authentication methods), sure, would be rather problematic if they require you to have a phone, but that's a completely separate and different issue.
Companies tend not to do illegal things. Especially if they’re public or have shareholders that might lose significant value if found out. And it’s borderline impossible to stop people finding out.
Companies tend not to do illegal things when they're likely to get caught.
The trouble with data laws is that once they have your data, they're the only ones who actually know what they're doing with it. Which means the thing you need to prevent is them having it, which is typically not the thing those laws do.
You can check what data is getting collected (e.g. decompile their distributed app at different versions), and you can - as a government - actually just go to their servers and check what they are doing (with necessary permits and lawful action), or even mandate them to show the source code.
> You can check what data is getting collected (e.g. decompile their distributed app at different versions)
Which only helps if you're trying to prevent them from collecting the data rather than use it for a given thing, which is the thing they're not doing.
As an obvious example, if they keep all your files/messages on their cloud storage by default, they have all your files/messages by default.
> and you can - as a government - actually just go to their servers and check what they are doing (with necessary permits and lawful action)
Which generally only happens when you have reason to suspect they're doing something, which is the thing you wouldn't have when they're the only ones who know that they're doing it.
And even if you do go to look at the servers they have in your jurisdiction, there is no way to tell that the data hasn't been copied to servers outside of your jurisdiction, or what is happening to it over there.
On GrapheneOS you can install your bank app in a different user profile, and run Google Play sandboxed, so this scenario of a bank app doesn't result in anyone having access to your other information.
I empathise with GP’s anger. “You hold my money” should be enough of a reason to do all in their power to build great web apps and support alternative OS’es.
I find that banking apps deserve that extra bit of anger pointed towards them. (It’s also increasingly hard to find an ATM in many countries. What are banks up to?)
In my case, the app offers functionality that isn't available on the web version. So I resentfully use the app, but I'd prefer all features were available via the web instead.
meanwhile in my case the app offers functionality that isn't available on the web version while simultaneously requiring the web version for some of the things
Web banking means you need the card reader gadget as well for the authentication. The app uses secure features of the OS to aid authentication so you don't need to read the card. Web access on your phone still needs the card reader gadget.
Modern cards and phones support NFC, so you would only need a "gadget" (NFC reader) when using a PC that doesn't already have one, and a USB one is ~$20.
What this really needs is better browser support for NFC:
How often do you think companies are in the habit of doing things for your convenience?
Not who you replied to, but requiring me to install your app or create an account is usually going to mean I skip your thing unless I'm really motivated (or forced basically) to use it.
I use a terrible investment platform that purposefully nerfs the web app so you are forced to use the mobile app.
For something like a bank, I think they ought to be mandated to offer a functional website, yes. A slick app is nice too, but not if it’s the only option, specifically designed to steal my data and spy on me.
> I am not going to let you require that I run your proprietary malware in order to access my own money.
Why do they need to tailor to you how they do business? They could cut you off from accessing your money over the internet entirely if they wanted. They don't even have to offer a debit card, it could be a bank where you can only deposit and withdraw cash in-person.
My point is that you choose the institution you want to bank with based on what they offer and if it works for you. Banking is the poster child for an industry where people switch institutions based on what the institution offers.
> The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.
Corporations offer services for money only under very narrow requirements and conditions because relaxed requirements would cost them money overall. If people are expected to provide free compute, and 99.9999999% of your customer base is okay providing that free compute*, then they'll go that route.
*: The actual cost to run any given javascript or web app is probably less than a penny, even if you add the actual energy cost to do so plus amortize the hardware cost over the lifetime of your hardware
> Why do they need to tailor to you how they do business?
Exactly, VCRs should be banned -- why should cable companies tailor to you how they do business, and be forced to allow you to plug in anything into their distribution network? Only approved TVs should be an option.
I mean, I wouldn't be surprised if Walmart's Onn brand had the audacity to release a port-less smart TV and discount it even more since that would be guaranteed data collection / ad sales.
Hopefully people are educated about that fact before they purchase said TV, though.
HSBC pressure you into using the app and I don't think there is a way back to the battery powered OTP device. At least not that I know in the UK. I resisted until the battery failed and they basically make you go into the branch and then plead why you can't use a smartphone. got sick of this dance after 3 years
Maybe that works in the some countries, but among the 3-4 mainstream banks in my country, making that threat when you are anything less than an unusually high earner by local standards (and perhaps a customer of ancillary investment services) is just going to be met with "Fine, we'll close it then." You might be overestimating just how much banks need any one average person's custom. Also, by local cultural standards, making such threats to a business for the sake of obtaining better customer service is over-the-top Karen behavior, so you have already lost when you do that.
"I won't continue to be your customer if you cannot provide the service I need" Is not "Karen behaviour".
Continuing to patronize a business that will not sell you a product you want is being a pushover. The flip side is if a business is in the custom of only providing certain services to those who threaten to leave, then they shouldn't be surprised when people threaten to leave in order to receive good service.
I suspect that you live in Canada, which has the banking oligopoly that leads to banks not giving a shit, and customers that are used to banks not trying. If more people were willing to take their money and walk, Canadian banking would probably suck less ass.
I'd close my account anyway. If other banks are no better nor worse, then no reason to stay with the one you have.
But there should always be at least one bank which can give you what you want, whatever that is. There are dozens to choose between if you're banking in USD or EUR.
"There are dozens to choose between if you're banking in USD or EUR." No, in several EU countries there are just a literal handful after successive mergers.
As discussed elsewhere in this very thread, this is not always the case in practice. Neither one's national tax authorities nor one's employer may play ball regardless of what possibilities legislation supposedly offers. Also, login to government websites may require authentication via a bank app based on an account only in that country.
What's always funny to me about these threads is that my bank's app has always worked for me on every version of android I've tried. Rooted, not rooted, graphene, etc. It's always been fine and secure. So I actually kinda don't care what Europeans do. They are always a bit behind the times and a bit misunderstanding how technology works. That's why Americans say stuff like "just switch banks" because we're all a little astounded at what you guys over there will put up with.
I was responding to specifically the OP's mention of banking in EUR. However, a dearth of banks is not limited to said parts of Europe but can be found elsewhere in the world, too. So, your disparagement is uninformed.
Americans in these threads recommending switching banks are often unaware of how the USA is a relative outlier when it comes to diversity of banking. A lot of that is due to the rather distinctly American concept of the credit union. But within corporate banking, even the USA has seen successive mergers and some decline in choices.
I got a replacement widget recently, the website pushes the app but when I asked in branch they gave me one without even asking my name. I had to wait on the phone to register the new serial number, maybe I could've done that in person too, but it lasted years (and multiple phones) so I don't mind too much
Most of those devices are interchangeable, so if you have one from NatWest, Barclays etc it will probably work with your card. It's also possible to replaec the battery on most of them.
That is not the same Walt. I'm assuming you found the TrustPilot site for https://walt.io, which is some Telegram crypto thing from the US. What GP linked to is an independent wallet app that currently supports passes and is scheduled to support tap-to-pay in the near future.
Right... and let's just hope those banks pushing the app-everything culture with semi-working web interfaces still online don't start requiring unauditable WASM binaries to run them.
>Why do you expect me to be your distributed infrastructure provider?
...You realize that we're talking about banks, right? Institutions operating on a fractional reserve? Take your money, use it as collateral to print 10x their holdings in interest-bearing debt? Free to restrict your withdrawals and bail-in funds from your account to save their own hides? Those banks.
The Occupy Wall Street and Bitcoin dudes and dudettes had it right, which is why they were carefully marginalized and appropriated, respectively.
If you have Bitcoin in a self-custody wallet, is there a bank corporation to "restrict your withdrawals and bail-in funds from your account to save their own hides"?
My bank pestered me so much to use their app that I eventually caved in. Ironically, they claim it's more secure than normal internet banking from the PC with 2-factor authorization, even though they send the SMS token for in-app transfers to the same phone as the app...it makes no sense.
"Let you hold my money"? In what society is that true? Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank. They have an immense amount of power and operate in a heavily regulated area so there's guaranteed to be very little competition.
Voting with your wallet does not work here. There is only a handful of banks, and in many (most?) countries they all force proprietary software and/or unreasonable contracts on their customers, switching between them does not help.
> Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank.
After getting screwed around by my bank (ASB) I am looking to get away from them. Wise is tempting. They are not a bank.
My salary can go to them. Why would I need a bank for taxes or my children?
The only thing holding me back is the fact that money isn’t government guaranteed as secure with them. With ASB NZ$100k is government guaranteed.
By GrapheneOS, they mean "official builds of GrapheneOS". If you build GrapheneOS yourself, you won't be allowed to use these banking apps due to remote attestation.
I think this is the real problem here if it's true. The community must absolutely retain the ability to fork the project and reintroduce things like root that the developers are obstinately against. If not, then Graphene will simply become another Google/Apple.
The fact that GrapheneOS digitally signs their releases doesn't make them not open source. This is indeed a bad situation, but the badness is 100% the fault of Google for having a hardware attestation "feature".
GrapheneOS is open source. This has no connection to open or closed source. GrapheneOS has heavily pushed back against apps using remote attestation to restrict which operating systems and hardware can be used. When apps are unwilling or unable to remove it such as due to government regulations, we try to convince them to permit GrapheneOS and other alternatives via a standard Android API instead of only using the Play Integrity API.
Banks are increasingly adding checks for Google certified devices. In the EU, there are regulations requiring banks to start verifying device integrity. It's headed that way worldwide with a growing number of regulations and industry standards requiring it. Apple's App Attest API and Google's Play Integrity API have repeatedly been the only options recommended by the EU which has contributed to the worsening situation in the EU in particular. We convinced the EU to remove those specific examples from several official standards. No one has been able to convince them to stop heading down this path despite a lot of people pushing back against it. We haven't been able to convince them to define actual requirements let alone to require permitting anything which meets those requirements. They give a vague description of what they require doing shaped around the Apple and Google integrity APIs.
We convinced around a dozen banks mostly in the EU to use the standard Android key attestation API included in the Android Open Source Project as an alternative. It allows apps to verify the OS verified boot key hash, patch level, app signing key hash(es) and app version code based on a root of trust. This meets the requirements for the EU standards and enables permitting any alternative with verified boot and a mandatory app sandbox with support for verifying the app's signing key and passing it to the hardware keystores. Other operating systems can publish their signing keys in the signed JSON format we published and ask the same companies to include their keys too.
Once apps implement an alternative to the Play Integrity API to permit a single OS, it's easy for them to add more. The hardest part is getting them to even consider doing it. It's nearly impossible to get in contact with the right people and to convince them to do it. Once we establish that contact and convince them to ship it, it's a lot easier. There has been an ongoing issue of these apps not adding our new verified boot keys which are per-device-model for security reasons similarly to the Pixel OS. We tried to solve that by creating a standard signed JSON format which can be automatically retrieved and used to automatically include the new signing keys. Exactly the same approach can be used to delegate certification and inclusion of arbitrary operating systems to other organizations. It can also be used for handling which roots of trust for non-Google-certified hardware are also permitted.
We would prefer if none of this existed but we don't live in that world and we're doing what we can to convince apps to permit GrapheneOS and other alternatives. We're heavily fighting against it being done in the first place and against more standards and regulations requiring it. We're also fighting against more centralized attestation systems such as the Play Integrity API as opposed to systems with actual standards where anything meeting those standards can be included. It would not be a good thing for there to an EU alternative to the Play Integrity API permitting specific operating systems and devices based on geopolitics and business interests. That would only accelerate adoption of attestation by EU apps which is already happening at a faster pace than elsewhere thanks to both EU regulations and what many of the countries are doing themselves.
In my experience with UK banks & financial institutions, GrapheneOS support can be roughly divided into four types.
None. Explicitly banned. And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
Some. App works, but some functionality is unavailable. I've got a credit card app which works, but refuses to set up virtual cards or use "remember me". That's good enough for my use. Similarly, I had a merchant account which let me see my balance, but I couldn't use my phone as a credit card reader.
Works, but only in main profile. I'd rather keep financial things in a locked profile. But lots of banks disallow that.
Full. Everything works (although you may need to toggle some exploit protection off).
Some banks are reasonably good at letting you pass on technical queries to their developers - mostly the smaller ones. The nice thing about the UK banking sector is that it is trivial to move banks. So I switched accounts to providers which worked with my phone and let the old ones know why I was moving.
Without evidence that using an OS that isn't approved by Google or Apple actually correlates with a higher rate of account compromise or fraud, I do blame them for trying to force it on users.
I've done a couple casual web searches for such evidence and come up short. If somebody has good data on this, I don't think they're publishing it.
I'm pretty sure it's actually anti correlated: not because degoogled Androids are safer by themselves, but because the average user is way savier than the average Joe (which have an out of date Android full of unpatched security vulnerabilities, in the first place).
My theory is that they're trying to counter simulated phones. In the old days fraudsters would use their stolen credentials on a windows RDP rented from someone who sells fraud infra with clean IPs. I wouldn't be surprised if fraudsters have tried to develop an android based VM meant to look like a legitimate customer endpoint.
Though the most effective way to cut out that kind of fraud is to stop using SMS for authentication, which banks don't seem to be interested in doing.
That's my first instinct too. I've seen a claim that devices with root, which is distinct from degoogled, both of which are distinct from using a third-party Android distribution, have an increased probability of malware. I suspect that statistic includes things like secondary devices people use for cheating in pay-to-win games and the like.
Since that’s “likely” correlated (and a “likely” is often enough), a product manager will take the most optimal decision for themselves and the company - reject such use cases as unsupported. This is easier than to manage such an edge case for “a few” legitimate users.
Few orgs understand compliance. While there might be some compliance people at the org level, individual teams implementing features will need to have a good line to them. In the end, knowledge is siloed and everyone needs to deliver on time. So it’s easier to forbid with some controlled collateral damage than to permit with an uncontrolled downside variance. Just a derisking hedge.
Serving use cases that drift away a bit “too far away” from the average (+ some sigmas) use case is not economically justified for a product manager - their KPIs would deteriorate from such “altruism”. No one will care if a few low-margin customers can’t use the product.
> And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
This argument has never held any water for a simple reason:
Consider 2 phones.
1. Runs self-built lineageos (latest version), with magisk installed.
2. Runs official stock ROM, no mods, all apps from Play Store. Also, hasn't gotten any updates in 6-9 months and is running a 4.4.x kernel that isn't even the latest version on its branch.
If your app blocks phone 1 and allows phone 2, then you're doing security theater in a way that actively undermines actual security. The ability for a user to flash an OS or allow apps root access doesn't make a device insecure, but the ability for any app to grant itself root because the vendor can't be bothered to patch the OS certainly does.
> ”If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them.”
This obviously depends on jurisdiction, but how commonly is this actually the case?
I’ve thankfully never personally been on the receiving end of fraud or identity theft, but my impression is that here, everything that happens up until the point you tell your bank ”hey, uh, I think my account’s been compromised” is pretty much on you. I don’t think rooting your phone, installing a banking app from some umauthorized source et.c would be hard to construe as negligence.
In the UK, the bank is liable for any transactions on your account that you didn't approve. Doesn't matter that they thought you approved it because someone knew your pin, or compromised your device.
Unless the bank has reason to believe that you're either trying to defraud the bank, or where unduly careless with your banking credentials (and you have to be really careless to meet that bar in the eyes of the regulator and the courts), then they're expected to refund you.
I've seen banks refund £100ks to customers that were defrauded over many months via romance scams. There are cases ruling by the Financial Ombudsman forcing banks to refund customers to handed over their cards and PINs to carers that then stole money.
The general attitude of the law in the UK, the regulators, and the courts, is basically it's the banks responsibility to provide appropriate security, in a form that their customers can easily use and understand. If banks want to make it easy for customers to move and spend money, then the risks associated with that convenience accrue with the bank, not their customers.
Obviously banks work very hard to worm their way out of their responsibilities here. But if you use the consumer protection tools that exist in the UK, which are very easy to access, and which your bank is required to inform you of, then it's surprisingly easy to force a bank to refund you for any fraud you suffer.
> In the UK, the bank is liable for any transactions on your account that you didn't approve.
The question isn't whether they have to refund the money when the customer gets defrauded. The question is whether preventing the customer from using a less popular OS in any way prevents them from being defrauded.
To which the answer is somewhere between "negligible difference" and "it's actually anti-correlated with that because the custom ROM is more up to date".
Notice that requiring the attacker to use a phone doesn't do any good, because the attacker can just use a phone.
I don't know anything about the actual legal responsibilities, but even there aren't any, a defrauded customer takes up support resources just having the conversation about it. Upset customers (regardless of how well placed that upset is) will complain about it in reviews etc.
A lot of people aren't able to distinguish "I got scammed" from "the bank took my money away".
If the banks were really so concerned about malware on the user's endpoint, and they had competent CTO, then they would write an app for Trezor or offer a Trezor with their own logo and app on it and users could sign transactions with it.
Trezors show on a screen to the user "this is the amount and where to be sent that you are signing for".
Malware with high privileges on a compromised user endpoint can bamboozle the user but a hardware wallet would catch that.
I don't know where you live or with whom you bank, but there were plenty of hardware tokens for banking for almost two decades until phone apps took over. They are not likely to return. Managing many hardware tokens is a big undertaking and people regularly forget them or destroy them. Phones are so much easier and people generally don't want to carry extra devices. They don't even want to carry comparably tiny credit cards given the choice.
You are suggesting an entirely second piece of hardware when there are people in this thread claiming (IMO correctly) that many customers prefer an app over the browser because it's very mildly more convenient.
And there is a very large swath of banking customers who I wouldn't be surprised to learn that banks will earn less than $130 from over the course of a decade.
Correct, an enTiReLy second piece of hardware. That's the whole point of a hardware wallet.
The use can be optional, I don't think anyone would suggest (or even presume?) otherwise.
Accounts with balance under $30,000 need not apply.
Many of the "good customers" (from a bank's perspective) already have a Trezor.
Big banks already require customers pay the $50 for an RSA fob anyway. No bank is providing these devices as a courtesy.
Many GrapheneOS users would rather pay out of their own pocket for a Trezor Safe 5 than have "you need to carry an additional phone too, a shit-phone" forced on them when GrapheneOS is perfectly adequate to run any app and with more meaningful security assurances than any other Android distro.
Maybe I misunderstood the point you were trying to make with your original comment, but you seemed to be suggesting that this piece of hardware could negate the risks (from the banks perspective), of allowing their apps to support non-secure devices. If your suggestion only applies to a very small subset of customers, then that doesn't allow them to put their app (which every customer can use), on the untrusted devices.
The existing customers of large banks who have hardware RSA devices are not "a very small subset of customers". Most of the customers who actually matter to the bank already have hardware devices, but with inferior cryptography and hardware aspects inferior to Trezor.
Boomers don't generally have Trezor wallets. Many millennials who aren't in the "failed to launch" category have a Trezor wallet or something similar, as do gen Z.
A Pixel running GrapheneOS is hardly a "non secure" device. As a user, I'm not naive enough to consider iOS or lamestream Android to be "trusted", which is why I run GrapheneOS.
If a bank's app runs on iOS or lamestream Android, but not GrapheneOS, it's not because those operating systems that aren't GrapheneOS are more "trusted", it's because the CTO of the bank is a fucking moron.
Trezor runs open source firmware. Solving the problem with a Trezor is what I want and what most loosely in the category of "hacker" want. Every legitimate IT pro will prefer, for securing their own bank account, this approach over another.
Whatever bank can set whatever threshold they want.
If they want to require a signature from a hardware wallet where their app runs on an unrecognized OS or for a Zelle transaction over $3,000 then they can specify whatever details they want in software at the speed of software. Banks already tune thresholds unique to customer's individual risk profiles.
As has already been widely demonstrated with some of the hardware keys in the Yubikey 5C family, users don't lose their hardware keys/wallets when they are attached to their physical key ring for house key/fob and car key/fob etc. Users cycle through or lose smartphones all the time but "muh keys" not so much.
>If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them.
I keep reading this justification, and it doesn't make an ounce of sense to me.
first of all, the number of people who want to root their phones is a fraction of 1%. children, teenage girls, and senile boomers don't do that. the number of people with rooted phones who could fall for "hello sir, I am sir John Whiteman from Microsoft, you're phone have virus, sir, please do the needful install this a pee kaa, sir" is near zero.
second of all, phones get stolen all the time, and it would make sense to reduce liability by not providing apps at all.
> people who want to root their phones is a fraction of 1%. children, teenage girls…
If someone lies to them and tells them there is an app that lets them get free Roblox bucks or whatever, but first they have to root their phone, they will. If someone lies or makes an app that removes pimples or adds makeup in realtime, or something, but they make it only work on rooted phones, they will.
I did a rough estimate of all the people I know and the number of those people who would want to root their phone. It’s not a big number but it’s way bigger than “a fraction of 1%”.
And it’s a completely different demographic than those would would fall for the phone call scam, but it’s incredibly disingenuous of you to suggest that the only malware distribution vector is being tricked into installing an APK.
I know people who are interested in modding games, pirating software, and installing “cool” apps just for the novelty. I would argue the most likely reason those people installed malware is voluntarily, because they searched out a hacked version of Bloons Tower Defence. Not because they “needed to pay an outstanding Windows service bill”.
Would anyone know why? My understanding of profiles is arguably very limited, but I always saw those as equivalent to device owner profile from app runtime standpoint.
I’m not very familiar with android because I don’t daily it, but I have an old Pixel 4 with GOS that I was using to evaluate GOS. I know for example that some MDMs don’t work on a secondary “Work” profile in GOS, despite it being one of the main use cases for secondary profiles. If I recall correctly, it was because of how some MDMs can be configured by the organization’s admin they require some handshake with the Owner profile that doesn’t work in GOS. you would have to install them on the owner profile defeating the point I think,
I have two to add: Works, but only every other app version. Second: works if the aosp keyboard or gboard are active but not with LeanType. Easy fix once you know, but that was not a fun time debugging.
Question: In the UK, thanks open banking, couldn't you use a compatible bank like monzo and load all the other bank accounts via open banking into that single app?
Yes. Banks like Monzo allow you to import your other bank accounts into their app. I did it for a while, but ultimately I found it easier to just have separate apps for each. Most apps are very good and improving all the time, so usually one isn’t much better than the other.
I haven’t looked for a one-app-to-rule-them-all, but in principle it’s possible.
I think the UK banking sector is in rude health. It’s very competitive and it’s easy to move. The quality of the apps is very much part of any competitive advantage.
I have accounts with four uk banks and it’s trivial to manage them. It’s an example of legislation working really well.
> The nice thing about the UK banking sector is that it is trivial to move banks.
Are there countries where this is a hassle? Now I've only had personal banking accounts in ~3 countries (so far?), so maybe I'm in a bubble, but in none of the countries has "switching banks" been more than basically create a new account, start using new IBAN for incoming transfers, move direct debits to use new IBAN and start using new card(s). Those last two were even automatic in the last move I did for a lot of stuff. Is it typically more difficult than that in other countries?
There are countries where, as a result of mergers, banking is now down to 3-4 banks, and they all have the same Android requirements, so switching won't get one anywhere.
If those countries are in the EU, you have the right to use a bank based in another EU country. The traditional incumbents will likely demand an in-country residential address (in direct contradiction of EU law). Which leaves the internet-only neobanks. I believe the only FOSS-compatible option is Wise, which has a modern web offering and does not even require that you install a native app. I understand N26 does, but it may work with Graphene. By contrast Revolut is a privacy-invading walled garden and should be avoided at all costs.
If you are not a citizen, but an immigrant, it could be very true in some parts of the world.
I have a living permit and legal status in the country I live in, but only few banks open accounts to people like me, most just deny anyone but citizens of the country.
The ones that open all work in GrapheneOS though, so not big deal for me in my particular case.
Having the debits move to the new IBAN automatically had to be mandated and built. It doesn't just happen. In markets with large incumbent banks they have no incentive whatsoever to make switching easy.
It automatically moves all of your Direct Debits, recurring payments, balance etc. It even redirects incoming payments to your old account to your new one.
Having to change IBAN is a hassle, and shouldn't have been necessary. In fact, I think some countries (Germany?) actually got that right, and allow you to take your IBAN with you when switching banks. Like keeping your phone number when switching telco.
Why is that so much of a hassle? In the US switching banks is just updating some numbers and reconnecting. The entire process can just be done online. In the US the only annoying part can be older companies that still do the account verification via a deposit and withdrawal, so it takes one whole day instead.
Also I don't think I would actually want it done automatically. Some banks have better saving rates, some banks offer higher interest on checking, some banks are much better for taking cash out internationally, some banks have more ATMs/branches around where I live, etc. I have a few different banks I move money around in.
> None. Explicitly banned. ... I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
I mean this is the whole reason GrapheneOS does not ship a rooted version that they attest to. I doubt they are explicitly banning GrapheneOS, what they are doing is only trusting Google attestation.
The reason some banks explicitly allow GrapheneOS is because its easy for them to also trust GrapheneOS attestation, because it is not a rooted OS, and sensible security teams in banks can see that its more secure than any other Android phone including Pixels.
I wish people would understand this better, its what gives GrapheneOS a fighting chance of becoming a legitimate open source mobile OS that is accepted as secure for consumer use and that is not controlled by Apple or Google.
That's not the whole reason, or even the main reason GrapheneOS doesn't support or encourage root access.
The central design theme of GrapheneOS is to have stronger sandboxes and more limits on what apps can access than stock Android does. Granting an app root access does exactly the opposite; someone behaving rationally and consistently usually won't want to do both on the same device.
> though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
Most of us understand the desire to protect customers from fraud, but I don't think we should accept blanket restrictions on everyone's freedom simply because some people might make poor security decisions.
There's also the unspoken/uncomfortable economic reality here: the optimal level of fraud isn't zero. At some point, the cost of preventing additional fraud, including the loss of individual choice and autonomy, exceeds the benefit.
Could we aim for proportionate, evidence-based security rather than treating the least capable user as the benchmark for everyone?
The scope is much smaller than that: restriction on what banking conveniences are provided.
> Most of us understand the desire to protect customers from fraud
> At some point, the cost of preventing additional fraud, including the loss of individual choice and autonomy, exceeds the benefit
> Could we aim for proportionate
I think you have answered your own question here; if a less than single percentage of retail customers use something that's not a general iOS or Android device, anything beyond that is not really worth it until regulation says otherwise.
> The scope is much smaller than that: restriction on what banking conveniences are provided.
The freedom to install whatever OS you like on your own phone?
> if a less than single percentage of __________ anything beyond that is not really worth it
My goodness one could fill in that blank in so many different ways, and all of the ones I can immediately think of would drag this thread straight into any number of dire arguments, so I'd better not.
Could be general polarisation, or just that it's a "but in my case it is different" visceral response.
While people might not be moved by data, it would be interesting if some more public information on what people actually use was available. Imagine data points like unpatched/unpatchable iOS or Android devices being multiple percentages, or outdated browsers. Similarly, the effort per app/OS combination; if it costs X to support Y configuration, then it would be somewhat easier to see if it's more about the will to do anything rather than real-world problems.
There's five banking apps that support it specifically listed here [1]. I guess the dozen is not listed somewhere. Roblox, Hyundai, and Kia are also apps that officially support GrapheneOS. We should note that not all that are supporting it are using attestation.
I find all the people complaining about this to be rather insane. This is a completely open source linux distro getting official support from banks, some of the most legacy companies of all. This is good news. If companies are open-minded enough to support GrapheneOS, they're gonna be much more likely to also officially support other secure operating systems that are open source.
These are banking apps that weren't previously possible to be used on GrapheneOS. We're going from zero to one, not a step back.
Hm, what's the definition of works? https://github.com/PrivSec-dev/banking-apps-compat-report/is... - closed without a fix for Zelle. Another user later opened a ticket about Zelle not working, and it got closed as a dupe of the first, which had been closed 2-3 years earlier. Not promising.
True. Those who only care about meeting regulatory requirements are not going to care if the regulatory requirements cease to exist. Those who care about security may be dismissive of regulatory requirements, but they will do so primarily when they are insufficient or when they conflict with their opinion. In the former case, they probably have the ability to go beyond the regulatory requirements. In the latter case: while I won't claim that regulations are perfect, I would trust them over the an anonymous person who may be going on anything from their personal opinion to legitimate research.
Currently, besides if you use cryptocurrencies, I don't think you can rely solely on "written regulations and systems of checks", somewhere along those processes there are a bunch of humans with their altruism (or lack of), taste and daily life moving those processes along. And judging by the state of the cryptocurrency ecosystem, this is probably a good thing more than a bad thing.
Lmao, it's never legislation and/or enforcement. It's the checkboxes that their insurances told them they had to check or they wouldn't be covered. Half of the problem goes back to insurances being thieves who would do anything to not pay up, the other half goes to upper management not giving a shit about people.
Yep. I used to work for an FQHC, and the only thing that improved our network security was the insurance premiums we'd incur without proving compliance. Ofc course, HIPAA is a thing, but that was simply the baseline.
This post is awful, the link posted here is to a social media reply and even that reply does not contain a list of the 12 banks, it does however contain a link to a much larger list of banks, which are supported but not necessarily officially supported.
Let's hope your comment won't summon Daniel Micay to this thread once it's daytime in NA, dropping 10000-character comments on why all of us are wrong, flanked by his alt-accounts validating his every point and gaslighting whoever argues with him.
Go touch grass, what sort of positive beneficial value does this add to any conversation.
Your type make HackerNews more like Mumsnet full of feminine energy, gossip and character assassination avoiding a single logical thought or adding anything of technical value.
This asinine nonsense is like reading a 14 year old girls diary. Grow up.(And before you think going after my feels will help it won't chick, I know the above after laughing with my wife when we went back to hers.)
> banking apps began specifically permitting GrapheneOS
In my view, that's not any better than specifically permitting Google only. This should not be a whitelist at all. I assume my self-signed GrapheneOS would fail this test?
In Germany Sparda-Banken and, I think, Volks- und Raiffeisenbanken support tap-to-pay through their apps. (And maybe other banks providing apps developed by the same contractor, Atruvia AG.)
PayPal also offers tap-to-pay, though I recently had to disable Graphene's "secure app spawning" feature for the PayPal app to get it to open.
I wonder how many of these supported apps are supported, because there are some geeks on the inside of the banks who want to have their favorite mobile OS supported.
Why not just use a web app from laptop at home? Why do you even need an app on your phone? So that you can urgently transfer money to some scammers you met in the street?
I do not have any banking apps, and I log into a bank account maybe once in month or less often.
Agreed that a website should be fine, but (Dutch) banks require the app as a second factor to log into the website. Fido2 hardware tokens could replace the bullshit requirement of "choose Apple or Google to be your overlord in order to use our service".
Ehm, no. They don’t all do at least. For one, Rabobank does not require it. You can use the app to authorize in the browser. But for big transfers you still need their Rabo Scanner (which you get the first one of for free).
Unfortunately the only way I can spend directly from my work-sponsored FSA account is if I download their app. I haven't, since I can still just submit receipts, but they won't send you a physical card.
In Russia, all banks I tried, are usable via web app (because smartphone apps live only 1-2 months before they are detected and removed from app stores). The disadvantage of a web app is that it is not always-on, doesn't allow tracking users are well as a real app, and cannot display advertisement notifications.
Mine (KH bank) does perform a safetynet attestation that fails, as I don't even pass basicintegrity, then proceeds to completely ignore the result and still let me in on GOS.
(FWIW, sometimes when you _block_ the app from the Play Integrity API (in this pop-up) the app that wants to perform the check works, while it fails when you do not block it)
I always have to roll my eyes when someone tells me they consult for banks like that's supposed to be impressive.
That crowd thinks 12 Factor applications are some monumental thing, "oh no, we can't do that, we would have to hire only the most expert experts, nobody does 12 Factor applications". They're all Windows tards.
Then as highlighted the other day, the big banks, including LLoyds, all run on Google's Cloud because ding ding ding big surprise they couldn't figure it out themselves, and they didn't deploy multi-AZ. They didn't do a rudimentary thing that virtually every startup knows to do and does.
The banks and the clowns that surround them are, by today's standards, barely computer literate.
It's properly sandboxed, which is a lot better than Google Play Services on regular Android. Far from ideal of course, but I assume GrapheneOS is built with those people in mind for whom Google is unavoidable.
This post is actually really bad for a Hn post, it appears to be a reply to someone else hence the lack of context here, and the link appears to be a list of banking apps that are have some level of compatibility at all, not the official 12.
Very good news. It's a good sign if banking companies are considering the actual security issues at play and not just blindly rejecting all unofficial ROMs.
It's not Pixel only for no reason, there aren't any other phones which meet the rather sensible requirements at this moment. And even the latest Pixel phones have regressed.
Complain to other hardware vendors that they sell insecure crap or do not release updates :/
And yeah, it'll be Motorola from the next year on, but a proper, first party cooperation. I think that Motorola wants to become the answer to the question: "what's the best, safest android smartphone?"
Good. I am tired of vendor-lock-in of a few corporations
dominating the world here. Capitalism was never
corporate-fascism - after all one element is free competition
in a free market. This has been broken numerous times again
and again, and the US justice department is deliberately
unwilling to remedy this situation - thus also betraying
the idea behind capitalism. No wonder since the orange
mafia is running the show right now, with all signs of
real dementia now being obvious.
Capitalism was never the same as free-market. In a free market there's competition, but in capital-ism it's all centralised at a few people, the ones who have all the capital.
After that guy was arrested for wiping his GrapheneOS phone with a duress password, some reports appeared of previously usable apps becoming unusable specifically on GrapheneOS. This now reads like a possible reversal of that trend.
Where is this list of 12+ banks that explicitly allow graphene. My understanding is if the banks do not explicitly state support also in terms of ToS, they might pull the rug any moment. With neo banks you are then basically left without a bank.
I found some evidence of half a dozen that there might be support 'by desogn' (all of them might pull the rug at any time again as far as I understand TOS, which however seems true for any android in theory): Swissquote, Yuh, UBS, Starling Bank, Triodos Bankieren NL, AmeriCU Credit Union. More?
Thanks, but no thanks?
I use GrapheneOS, but if you as a bank want to gate access to my money via some kind of technology, you better be including it as part of the account.
For example, HSBC continues to let me manage my bank account via the web browser, and continues to offer a battery powered hardware token as the means of authentication.
I let you hold my money, for whatever reason. Why do you expect me to be your distributed infrastructure provider? I am not going to let you require that I run your proprietary malware in order to access my own money.
The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.
I'd say that JS webapps are the same but at least there you run things on your terms in a sandbox that you can inspect and look at the requests, and there's no effective enclave carved out of your hardware (except for EME but that's another topic for another day and I'd be complaining if banks started to use it too).
You might be overthinking it. Most people want to use their phone for convenience, and if an app allows them to remove just one step in their banking activities, they'll probably do that.
As for the second part (separate authentication methods), sure, would be rather problematic if they require you to have a phone, but that's a completely separate and different issue.
Most people don't know they're also being taken advantage of. I'm mostly referring to data exfiltration.
Which isn’t legal in Europe and the UK. Get better consumer protection laws.
Good thing that companies never do anything illegal, and everyone lives in Europe.
It’s good for us Europeans ;)
Companies tend not to do illegal things. Especially if they’re public or have shareholders that might lose significant value if found out. And it’s borderline impossible to stop people finding out.
Companies tend not to do illegal things when they're likely to get caught.
The trouble with data laws is that once they have your data, they're the only ones who actually know what they're doing with it. Which means the thing you need to prevent is them having it, which is typically not the thing those laws do.
You can check what data is getting collected (e.g. decompile their distributed app at different versions), and you can - as a government - actually just go to their servers and check what they are doing (with necessary permits and lawful action), or even mandate them to show the source code.
> You can check what data is getting collected (e.g. decompile their distributed app at different versions)
Which only helps if you're trying to prevent them from collecting the data rather than use it for a given thing, which is the thing they're not doing.
As an obvious example, if they keep all your files/messages on their cloud storage by default, they have all your files/messages by default.
> and you can - as a government - actually just go to their servers and check what they are doing (with necessary permits and lawful action)
Which generally only happens when you have reason to suspect they're doing something, which is the thing you wouldn't have when they're the only ones who know that they're doing it.
And even if you do go to look at the servers they have in your jurisdiction, there is no way to tell that the data hasn't been copied to servers outside of your jurisdiction, or what is happening to it over there.
Oh this argument again? Yeah why have any laws at all /s
On GrapheneOS you can install your bank app in a different user profile, and run Google Play sandboxed, so this scenario of a bank app doesn't result in anyone having access to your other information.
This is pretty extreme, it’s just an app for your convenience. I agree that web access should be provided too, but most people find apps more useful.
Do you not run apps at all?
I empathise with GP’s anger. “You hold my money” should be enough of a reason to do all in their power to build great web apps and support alternative OS’es.
I find that banking apps deserve that extra bit of anger pointed towards them. (It’s also increasingly hard to find an ATM in many countries. What are banks up to?)
In my case, the app offers functionality that isn't available on the web version. So I resentfully use the app, but I'd prefer all features were available via the web instead.
meanwhile in my case the app offers functionality that isn't available on the web version while simultaneously requiring the web version for some of the things
I’m with you, except that in this situation I resentfully forego the feature because I refuse to install apps.
Web banking means you need the card reader gadget as well for the authentication. The app uses secure features of the OS to aid authentication so you don't need to read the card. Web access on your phone still needs the card reader gadget.
Modern cards and phones support NFC, so you would only need a "gadget" (NFC reader) when using a PC that doesn't already have one, and a USB one is ~$20.
What this really needs is better browser support for NFC:
https://developer.mozilla.org/en-US/docs/Web/API/Web_NFC_API
But so let's do that then.
> it’s just an app for your convenience
How often do you think companies are in the habit of doing things for your convenience?
Not who you replied to, but requiring me to install your app or create an account is usually going to mean I skip your thing unless I'm really motivated (or forced basically) to use it.
Well, their competitive advantage too, but they don’t have to be mutually exclusive
I will do what I can to avoid using apps.
I use a terrible investment platform that purposefully nerfs the web app so you are forced to use the mobile app.
For something like a bank, I think they ought to be mandated to offer a functional website, yes. A slick app is nice too, but not if it’s the only option, specifically designed to steal my data and spy on me.
> I am not going to let you require that I run your proprietary malware in order to access my own money.
Why do they need to tailor to you how they do business? They could cut you off from accessing your money over the internet entirely if they wanted. They don't even have to offer a debit card, it could be a bank where you can only deposit and withdraw cash in-person.
My point is that you choose the institution you want to bank with based on what they offer and if it works for you. Banking is the poster child for an industry where people switch institutions based on what the institution offers.
> The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.
Corporations offer services for money only under very narrow requirements and conditions because relaxed requirements would cost them money overall. If people are expected to provide free compute, and 99.9999999% of your customer base is okay providing that free compute*, then they'll go that route.
*: The actual cost to run any given javascript or web app is probably less than a penny, even if you add the actual energy cost to do so plus amortize the hardware cost over the lifetime of your hardware
> Why do they need to tailor to you how they do business?
Exactly, VCRs should be banned -- why should cable companies tailor to you how they do business, and be forced to allow you to plug in anything into their distribution network? Only approved TVs should be an option.
I mean, I wouldn't be surprised if Walmart's Onn brand had the audacity to release a port-less smart TV and discount it even more since that would be guaranteed data collection / ad sales.
Hopefully people are educated about that fact before they purchase said TV, though.
HSBC pressure you into using the app and I don't think there is a way back to the battery powered OTP device. At least not that I know in the UK. I resisted until the battery failed and they basically make you go into the branch and then plead why you can't use a smartphone. got sick of this dance after 3 years
The magic words that work at most banks are "close my account", but you have to be prepared to actually close your account if they don't back down.
Maybe that works in the some countries, but among the 3-4 mainstream banks in my country, making that threat when you are anything less than an unusually high earner by local standards (and perhaps a customer of ancillary investment services) is just going to be met with "Fine, we'll close it then." You might be overestimating just how much banks need any one average person's custom. Also, by local cultural standards, making such threats to a business for the sake of obtaining better customer service is over-the-top Karen behavior, so you have already lost when you do that.
"I won't continue to be your customer if you cannot provide the service I need" Is not "Karen behaviour".
Continuing to patronize a business that will not sell you a product you want is being a pushover. The flip side is if a business is in the custom of only providing certain services to those who threaten to leave, then they shouldn't be surprised when people threaten to leave in order to receive good service.
I suspect that you live in Canada, which has the banking oligopoly that leads to banks not giving a shit, and customers that are used to banks not trying. If more people were willing to take their money and walk, Canadian banking would probably suck less ass.
Why wouldn't you close your account if they don't provide what you want? It's not an empty threat, just a fact.
Because you won't get what you want at any other bank, either. Hardware tokens are viewed as superseded and phased out everywhere.
I'd close my account anyway. If other banks are no better nor worse, then no reason to stay with the one you have.
But there should always be at least one bank which can give you what you want, whatever that is. There are dozens to choose between if you're banking in USD or EUR.
"There are dozens to choose between if you're banking in USD or EUR." No, in several EU countries there are just a literal handful after successive mergers.
You can get a EUR bank in a different EU country, unless you're some kind of thrall.
As discussed elsewhere in this very thread, this is not always the case in practice. Neither one's national tax authorities nor one's employer may play ball regardless of what possibilities legislation supposedly offers. Also, login to government websites may require authentication via a bank app based on an account only in that country.
What's always funny to me about these threads is that my bank's app has always worked for me on every version of android I've tried. Rooted, not rooted, graphene, etc. It's always been fine and secure. So I actually kinda don't care what Europeans do. They are always a bit behind the times and a bit misunderstanding how technology works. That's why Americans say stuff like "just switch banks" because we're all a little astounded at what you guys over there will put up with.
I was responding to specifically the OP's mention of banking in EUR. However, a dearth of banks is not limited to said parts of Europe but can be found elsewhere in the world, too. So, your disparagement is uninformed.
Americans in these threads recommending switching banks are often unaware of how the USA is a relative outlier when it comes to diversity of banking. A lot of that is due to the rather distinctly American concept of the credit union. But within corporate banking, even the USA has seen successive mergers and some decline in choices.
I got a replacement widget recently, the website pushes the app but when I asked in branch they gave me one without even asking my name. I had to wait on the phone to register the new serial number, maybe I could've done that in person too, but it lasted years (and multiple phones) so I don't mind too much
This probably won't help you in the UK, but for those in the US, Wells Fargo uses an optional RSA SecurID Device.
https://www.wellsfargo.com/biz/online-banking/securid/
Most of those devices are interchangeable, so if you have one from NatWest, Barclays etc it will probably work with your card. It's also possible to replaec the battery on most of them.
The one I got from Lloyds has a replaceable battery
hsbc app is also in the group that forces you to disable all keyboard apps (even Futo), and used only gboard or samsung.
I rather travel by horse down to my local bank to get my money than to use HSBC to do any sort of banking.
https://walt.is/
Wow - I really want that to succeed!
I like the idea but it has some pretty suspect TrustPilot reviews, and its connection to crypto is a bit of a red flag to me.
That is not the same Walt. I'm assuming you found the TrustPilot site for https://walt.io, which is some Telegram crypto thing from the US. What GP linked to is an independent wallet app that currently supports passes and is scheduled to support tap-to-pay in the near future.
> I am not going to let you require that I run your proprietary malware
This is likely meant as hyperbole, but South Korea's online banking requirements really tries to live up to this reputation
Right... and let's just hope those banks pushing the app-everything culture with semi-working web interfaces still online don't start requiring unauditable WASM binaries to run them.
Most banks will have a second option to stop you from closing your account with them, but it's hidden.
Maybe naive on my part, but from a security pov I trust my bank's app more than the browser on my pc.
JS webapps have one key feature in this respect, there's no possibility for banks to force particular OS/HW on you via attestation.
Passkeys come with device attestation.
So get them to remove support for device attestation from the spec, or don't use passkeys.
>Why do you expect me to be your distributed infrastructure provider?
...You realize that we're talking about banks, right? Institutions operating on a fractional reserve? Take your money, use it as collateral to print 10x their holdings in interest-bearing debt? Free to restrict your withdrawals and bail-in funds from your account to save their own hides? Those banks.
The Occupy Wall Street and Bitcoin dudes and dudettes had it right, which is why they were carefully marginalized and appropriated, respectively.
The bitcoin dudes and dudettes didn't understand how the same incentives that apply to fiat money also apply to bitcoin.
If you have Bitcoin in a self-custody wallet, is there a bank corporation to "restrict your withdrawals and bail-in funds from your account to save their own hides"?
My bank pestered me so much to use their app that I eventually caved in. Ironically, they claim it's more secure than normal internet banking from the PC with 2-factor authorization, even though they send the SMS token for in-app transfers to the same phone as the app...it makes no sense.
The EU two years ago rolled back all their proper OTP 2nd factor logins and now exclusively allow their EU app otp or sms
it's so obvious they need backdoor access it's not even funny.
Who is "they", and what do you mean by "backdoor access" to your bank account?
"Let you hold my money"? In what society is that true? Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank. They have an immense amount of power and operate in a heavily regulated area so there's guaranteed to be very little competition.
Voting with your wallet does not work here. There is only a handful of banks, and in many (most?) countries they all force proprietary software and/or unreasonable contracts on their customers, switching between them does not help.
> Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank.
After getting screwed around by my bank (ASB) I am looking to get away from them. Wise is tempting. They are not a bank.
My salary can go to them. Why would I need a bank for taxes or my children?
The only thing holding me back is the fact that money isn’t government guaranteed as secure with them. With ASB NZ$100k is government guaranteed.
Google tells me there are about 4.3k FDIC insured banks that operate in the US.
At what number would you consider this to be more than "very little competition"?
By GrapheneOS, they mean "official builds of GrapheneOS". If you build GrapheneOS yourself, you won't be allowed to use these banking apps due to remote attestation.
I think this is the real problem here if it's true. The community must absolutely retain the ability to fork the project and reintroduce things like root that the developers are obstinately against. If not, then Graphene will simply become another Google/Apple.
So it's not open source.
This is the problem with remote attestation. The free software foundation has been talking about this endpoint since the late 2000s.
Richard Stallman has been talking about this since the 80s. One of the most famous and relevant examples of this is "The Right to Read"[0], from 1997.
0 - https://www.gnu.org/philosophy/right-to-read.en.html
The fact that GrapheneOS digitally signs their releases doesn't make them not open source. This is indeed a bad situation, but the badness is 100% the fault of Google for having a hardware attestation "feature".
GrapheneOS is open source. This has no connection to open or closed source. GrapheneOS has heavily pushed back against apps using remote attestation to restrict which operating systems and hardware can be used. When apps are unwilling or unable to remove it such as due to government regulations, we try to convince them to permit GrapheneOS and other alternatives via a standard Android API instead of only using the Play Integrity API.
Banks are increasingly adding checks for Google certified devices. In the EU, there are regulations requiring banks to start verifying device integrity. It's headed that way worldwide with a growing number of regulations and industry standards requiring it. Apple's App Attest API and Google's Play Integrity API have repeatedly been the only options recommended by the EU which has contributed to the worsening situation in the EU in particular. We convinced the EU to remove those specific examples from several official standards. No one has been able to convince them to stop heading down this path despite a lot of people pushing back against it. We haven't been able to convince them to define actual requirements let alone to require permitting anything which meets those requirements. They give a vague description of what they require doing shaped around the Apple and Google integrity APIs.
We convinced around a dozen banks mostly in the EU to use the standard Android key attestation API included in the Android Open Source Project as an alternative. It allows apps to verify the OS verified boot key hash, patch level, app signing key hash(es) and app version code based on a root of trust. This meets the requirements for the EU standards and enables permitting any alternative with verified boot and a mandatory app sandbox with support for verifying the app's signing key and passing it to the hardware keystores. Other operating systems can publish their signing keys in the signed JSON format we published and ask the same companies to include their keys too.
Once apps implement an alternative to the Play Integrity API to permit a single OS, it's easy for them to add more. The hardest part is getting them to even consider doing it. It's nearly impossible to get in contact with the right people and to convince them to do it. Once we establish that contact and convince them to ship it, it's a lot easier. There has been an ongoing issue of these apps not adding our new verified boot keys which are per-device-model for security reasons similarly to the Pixel OS. We tried to solve that by creating a standard signed JSON format which can be automatically retrieved and used to automatically include the new signing keys. Exactly the same approach can be used to delegate certification and inclusion of arbitrary operating systems to other organizations. It can also be used for handling which roots of trust for non-Google-certified hardware are also permitted.
We would prefer if none of this existed but we don't live in that world and we're doing what we can to convince apps to permit GrapheneOS and other alternatives. We're heavily fighting against it being done in the first place and against more standards and regulations requiring it. We're also fighting against more centralized attestation systems such as the Play Integrity API as opposed to systems with actual standards where anything meeting those standards can be included. It would not be a good thing for there to an EU alternative to the Play Integrity API permitting specific operating systems and devices based on geopolitics and business interests. That would only accelerate adoption of attestation by EU apps which is already happening at a faster pace than elsewhere thanks to both EU regulations and what many of the countries are doing themselves.
In my experience with UK banks & financial institutions, GrapheneOS support can be roughly divided into four types.
None. Explicitly banned. And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
Some. App works, but some functionality is unavailable. I've got a credit card app which works, but refuses to set up virtual cards or use "remember me". That's good enough for my use. Similarly, I had a merchant account which let me see my balance, but I couldn't use my phone as a credit card reader.
Works, but only in main profile. I'd rather keep financial things in a locked profile. But lots of banks disallow that.
Full. Everything works (although you may need to toggle some exploit protection off).
Some banks are reasonably good at letting you pass on technical queries to their developers - mostly the smaller ones. The nice thing about the UK banking sector is that it is trivial to move banks. So I switched accounts to providers which worked with my phone and let the old ones know why I was moving.
Without evidence that using an OS that isn't approved by Google or Apple actually correlates with a higher rate of account compromise or fraud, I do blame them for trying to force it on users.
I've done a couple casual web searches for such evidence and come up short. If somebody has good data on this, I don't think they're publishing it.
I'm pretty sure it's actually anti correlated: not because degoogled Androids are safer by themselves, but because the average user is way savier than the average Joe (which have an out of date Android full of unpatched security vulnerabilities, in the first place).
My theory is that they're trying to counter simulated phones. In the old days fraudsters would use their stolen credentials on a windows RDP rented from someone who sells fraud infra with clean IPs. I wouldn't be surprised if fraudsters have tried to develop an android based VM meant to look like a legitimate customer endpoint.
Though the most effective way to cut out that kind of fraud is to stop using SMS for authentication, which banks don't seem to be interested in doing.
Which is silly because you can get an attested phone for like $50 and factory reset it between "customers"
What's actually used is banks of old, used phones with broken screens, controlled via usb. They can be had for rather cheap.
That's my first instinct too. I've seen a claim that devices with root, which is distinct from degoogled, both of which are distinct from using a third-party Android distribution, have an increased probability of malware. I suspect that statistic includes things like secondary devices people use for cheating in pay-to-win games and the like.
Since that’s “likely” correlated (and a “likely” is often enough), a product manager will take the most optimal decision for themselves and the company - reject such use cases as unsupported. This is easier than to manage such an edge case for “a few” legitimate users.
Few orgs understand compliance. While there might be some compliance people at the org level, individual teams implementing features will need to have a good line to them. In the end, knowledge is siloed and everyone needs to deliver on time. So it’s easier to forbid with some controlled collateral damage than to permit with an uncontrolled downside variance. Just a derisking hedge.
Serving use cases that drift away a bit “too far away” from the average (+ some sigmas) use case is not economically justified for a product manager - their KPIs would deteriorate from such “altruism”. No one will care if a few low-margin customers can’t use the product.
> And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
This argument has never held any water for a simple reason:
Consider 2 phones.
1. Runs self-built lineageos (latest version), with magisk installed.
2. Runs official stock ROM, no mods, all apps from Play Store. Also, hasn't gotten any updates in 6-9 months and is running a 4.4.x kernel that isn't even the latest version on its branch.
If your app blocks phone 1 and allows phone 2, then you're doing security theater in a way that actively undermines actual security. The ability for a user to flash an OS or allow apps root access doesn't make a device insecure, but the ability for any app to grant itself root because the vendor can't be bothered to patch the OS certainly does.
> ”If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them.”
This obviously depends on jurisdiction, but how commonly is this actually the case?
I’ve thankfully never personally been on the receiving end of fraud or identity theft, but my impression is that here, everything that happens up until the point you tell your bank ”hey, uh, I think my account’s been compromised” is pretty much on you. I don’t think rooting your phone, installing a banking app from some umauthorized source et.c would be hard to construe as negligence.
In the UK, the bank is liable for any transactions on your account that you didn't approve. Doesn't matter that they thought you approved it because someone knew your pin, or compromised your device.
Unless the bank has reason to believe that you're either trying to defraud the bank, or where unduly careless with your banking credentials (and you have to be really careless to meet that bar in the eyes of the regulator and the courts), then they're expected to refund you.
I've seen banks refund £100ks to customers that were defrauded over many months via romance scams. There are cases ruling by the Financial Ombudsman forcing banks to refund customers to handed over their cards and PINs to carers that then stole money.
The general attitude of the law in the UK, the regulators, and the courts, is basically it's the banks responsibility to provide appropriate security, in a form that their customers can easily use and understand. If banks want to make it easy for customers to move and spend money, then the risks associated with that convenience accrue with the bank, not their customers.
Obviously banks work very hard to worm their way out of their responsibilities here. But if you use the consumer protection tools that exist in the UK, which are very easy to access, and which your bank is required to inform you of, then it's surprisingly easy to force a bank to refund you for any fraud you suffer.
> In the UK, the bank is liable for any transactions on your account that you didn't approve.
The question isn't whether they have to refund the money when the customer gets defrauded. The question is whether preventing the customer from using a less popular OS in any way prevents them from being defrauded.
To which the answer is somewhere between "negligible difference" and "it's actually anti-correlated with that because the custom ROM is more up to date".
Notice that requiring the attacker to use a phone doesn't do any good, because the attacker can just use a phone.
I don't know anything about the actual legal responsibilities, but even there aren't any, a defrauded customer takes up support resources just having the conversation about it. Upset customers (regardless of how well placed that upset is) will complain about it in reviews etc.
A lot of people aren't able to distinguish "I got scammed" from "the bank took my money away".
A Trezor Safe 5 costs roughly $130.
If the banks were really so concerned about malware on the user's endpoint, and they had competent CTO, then they would write an app for Trezor or offer a Trezor with their own logo and app on it and users could sign transactions with it.
Trezors show on a screen to the user "this is the amount and where to be sent that you are signing for".
Malware with high privileges on a compromised user endpoint can bamboozle the user but a hardware wallet would catch that.
I don't know where you live or with whom you bank, but there were plenty of hardware tokens for banking for almost two decades until phone apps took over. They are not likely to return. Managing many hardware tokens is a big undertaking and people regularly forget them or destroy them. Phones are so much easier and people generally don't want to carry extra devices. They don't even want to carry comparably tiny credit cards given the choice.
You are suggesting an entirely second piece of hardware when there are people in this thread claiming (IMO correctly) that many customers prefer an app over the browser because it's very mildly more convenient.
And there is a very large swath of banking customers who I wouldn't be surprised to learn that banks will earn less than $130 from over the course of a decade.
Correct, an enTiReLy second piece of hardware. That's the whole point of a hardware wallet.
The use can be optional, I don't think anyone would suggest (or even presume?) otherwise.
Accounts with balance under $30,000 need not apply.
Many of the "good customers" (from a bank's perspective) already have a Trezor.
Big banks already require customers pay the $50 for an RSA fob anyway. No bank is providing these devices as a courtesy.
Many GrapheneOS users would rather pay out of their own pocket for a Trezor Safe 5 than have "you need to carry an additional phone too, a shit-phone" forced on them when GrapheneOS is perfectly adequate to run any app and with more meaningful security assurances than any other Android distro.
Maybe I misunderstood the point you were trying to make with your original comment, but you seemed to be suggesting that this piece of hardware could negate the risks (from the banks perspective), of allowing their apps to support non-secure devices. If your suggestion only applies to a very small subset of customers, then that doesn't allow them to put their app (which every customer can use), on the untrusted devices.
The existing customers of large banks who have hardware RSA devices are not "a very small subset of customers". Most of the customers who actually matter to the bank already have hardware devices, but with inferior cryptography and hardware aspects inferior to Trezor.
Boomers don't generally have Trezor wallets. Many millennials who aren't in the "failed to launch" category have a Trezor wallet or something similar, as do gen Z.
A Pixel running GrapheneOS is hardly a "non secure" device. As a user, I'm not naive enough to consider iOS or lamestream Android to be "trusted", which is why I run GrapheneOS.
If a bank's app runs on iOS or lamestream Android, but not GrapheneOS, it's not because those operating systems that aren't GrapheneOS are more "trusted", it's because the CTO of the bank is a fucking moron.
Trezor runs open source firmware. Solving the problem with a Trezor is what I want and what most loosely in the category of "hacker" want. Every legitimate IT pro will prefer, for securing their own bank account, this approach over another.
Whatever bank can set whatever threshold they want.
If they want to require a signature from a hardware wallet where their app runs on an unrecognized OS or for a Zelle transaction over $3,000 then they can specify whatever details they want in software at the speed of software. Banks already tune thresholds unique to customer's individual risk profiles.
As has already been widely demonstrated with some of the hardware keys in the Yubikey 5C family, users don't lose their hardware keys/wallets when they are attached to their physical key ring for house key/fob and car key/fob etc. Users cycle through or lose smartphones all the time but "muh keys" not so much.
>If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them.
I keep reading this justification, and it doesn't make an ounce of sense to me.
first of all, the number of people who want to root their phones is a fraction of 1%. children, teenage girls, and senile boomers don't do that. the number of people with rooted phones who could fall for "hello sir, I am sir John Whiteman from Microsoft, you're phone have virus, sir, please do the needful install this a pee kaa, sir" is near zero.
second of all, phones get stolen all the time, and it would make sense to reduce liability by not providing apps at all.
it's security theater.
> people who want to root their phones is a fraction of 1%. children, teenage girls…
If someone lies to them and tells them there is an app that lets them get free Roblox bucks or whatever, but first they have to root their phone, they will. If someone lies or makes an app that removes pimples or adds makeup in realtime, or something, but they make it only work on rooted phones, they will.
I did a rough estimate of all the people I know and the number of those people who would want to root their phone. It’s not a big number but it’s way bigger than “a fraction of 1%”.
And it’s a completely different demographic than those would would fall for the phone call scam, but it’s incredibly disingenuous of you to suggest that the only malware distribution vector is being tricked into installing an APK.
I know people who are interested in modding games, pirating software, and installing “cool” apps just for the novelty. I would argue the most likely reason those people installed malware is voluntarily, because they searched out a hacked version of Bloons Tower Defence. Not because they “needed to pay an outstanding Windows service bill”.
FWIW, GrapheneOS can't be rooted. It's far more safe for the bank than any other version of Android.
> Works, but only in main profile.
Would anyone know why? My understanding of profiles is arguably very limited, but I always saw those as equivalent to device owner profile from app runtime standpoint.
I’m not very familiar with android because I don’t daily it, but I have an old Pixel 4 with GOS that I was using to evaluate GOS. I know for example that some MDMs don’t work on a secondary “Work” profile in GOS, despite it being one of the main use cases for secondary profiles. If I recall correctly, it was because of how some MDMs can be configured by the organization’s admin they require some handshake with the Owner profile that doesn’t work in GOS. you would have to install them on the owner profile defeating the point I think,
I have two to add: Works, but only every other app version. Second: works if the aosp keyboard or gboard are active but not with LeanType. Easy fix once you know, but that was not a fun time debugging.
Question: In the UK, thanks open banking, couldn't you use a compatible bank like monzo and load all the other bank accounts via open banking into that single app?
Yes. Banks like Monzo allow you to import your other bank accounts into their app. I did it for a while, but ultimately I found it easier to just have separate apps for each. Most apps are very good and improving all the time, so usually one isn’t much better than the other.
I haven’t looked for a one-app-to-rule-them-all, but in principle it’s possible.
I think the UK banking sector is in rude health. It’s very competitive and it’s easy to move. The quality of the apps is very much part of any competitive advantage.
I have accounts with four uk banks and it’s trivial to manage them. It’s an example of legislation working really well.
> The nice thing about the UK banking sector is that it is trivial to move banks.
Are there countries where this is a hassle? Now I've only had personal banking accounts in ~3 countries (so far?), so maybe I'm in a bubble, but in none of the countries has "switching banks" been more than basically create a new account, start using new IBAN for incoming transfers, move direct debits to use new IBAN and start using new card(s). Those last two were even automatic in the last move I did for a lot of stuff. Is it typically more difficult than that in other countries?
It can hurt your credit score.
There are countries where, as a result of mergers, banking is now down to 3-4 banks, and they all have the same Android requirements, so switching won't get one anywhere.
If those countries are in the EU, you have the right to use a bank based in another EU country. The traditional incumbents will likely demand an in-country residential address (in direct contradiction of EU law). Which leaves the internet-only neobanks. I believe the only FOSS-compatible option is Wise, which has a modern web offering and does not even require that you install a native app. I understand N26 does, but it may work with Graphene. By contrast Revolut is a privacy-invading walled garden and should be avoided at all costs.
You’re right what the law says, but then you run into the Italian tax authority that will only accept an Italian IBAN to pay taxes.
N26 works with Grapheme but won't let you create a new account on Graphene and will make you go through identity verification hell.
Right, but that's something else. Can't you switch between those 3-4 banks though? That's what I though was possible more or less all over the world.
If you are not a citizen, but an immigrant, it could be very true in some parts of the world.
I have a living permit and legal status in the country I live in, but only few banks open accounts to people like me, most just deny anyone but citizens of the country.
The ones that open all work in GrapheneOS though, so not big deal for me in my particular case.
Having the debits move to the new IBAN automatically had to be mandated and built. It doesn't just happen. In markets with large incumbent banks they have no incentive whatsoever to make switching easy.
In the UK we use https://www.currentaccountswitch.co.uk/
It automatically moves all of your Direct Debits, recurring payments, balance etc. It even redirects incoming payments to your old account to your new one.
It other countries it is a lot less trivial.
Having to change IBAN is a hassle, and shouldn't have been necessary. In fact, I think some countries (Germany?) actually got that right, and allow you to take your IBAN with you when switching banks. Like keeping your phone number when switching telco.
Why is that so much of a hassle? In the US switching banks is just updating some numbers and reconnecting. The entire process can just be done online. In the US the only annoying part can be older companies that still do the account verification via a deposit and withdrawal, so it takes one whole day instead.
Also I don't think I would actually want it done automatically. Some banks have better saving rates, some banks offer higher interest on checking, some banks are much better for taking cash out internationally, some banks have more ATMs/branches around where I live, etc. I have a few different banks I move money around in.
Yeah, the Dutch banks really fucked us over by putting the bank code in the IBAN, so IBANs can't be moved to another bank.
> None. Explicitly banned. ... I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
I mean this is the whole reason GrapheneOS does not ship a rooted version that they attest to. I doubt they are explicitly banning GrapheneOS, what they are doing is only trusting Google attestation.
The reason some banks explicitly allow GrapheneOS is because its easy for them to also trust GrapheneOS attestation, because it is not a rooted OS, and sensible security teams in banks can see that its more secure than any other Android phone including Pixels.
I wish people would understand this better, its what gives GrapheneOS a fighting chance of becoming a legitimate open source mobile OS that is accepted as secure for consumer use and that is not controlled by Apple or Google.
That's not the whole reason, or even the main reason GrapheneOS doesn't support or encourage root access.
The central design theme of GrapheneOS is to have stronger sandboxes and more limits on what apps can access than stock Android does. Granting an app root access does exactly the opposite; someone behaving rationally and consistently usually won't want to do both on the same device.
> though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.
Most of us understand the desire to protect customers from fraud, but I don't think we should accept blanket restrictions on everyone's freedom simply because some people might make poor security decisions.
There's also the unspoken/uncomfortable economic reality here: the optimal level of fraud isn't zero. At some point, the cost of preventing additional fraud, including the loss of individual choice and autonomy, exceeds the benefit.
Could we aim for proportionate, evidence-based security rather than treating the least capable user as the benchmark for everyone?
> blanket restrictions on everyone's freedom
The scope is much smaller than that: restriction on what banking conveniences are provided.
> Most of us understand the desire to protect customers from fraud > At some point, the cost of preventing additional fraud, including the loss of individual choice and autonomy, exceeds the benefit > Could we aim for proportionate
I think you have answered your own question here; if a less than single percentage of retail customers use something that's not a general iOS or Android device, anything beyond that is not really worth it until regulation says otherwise.
> > blanket restrictions on everyone's freedom
> The scope is much smaller than that: restriction on what banking conveniences are provided.
The freedom to install whatever OS you like on your own phone?
> if a less than single percentage of __________ anything beyond that is not really worth it
My goodness one could fill in that blank in so many different ways, and all of the ones I can immediately think of would drag this thread straight into any number of dire arguments, so I'd better not.
Someone flagged this comment to death (I vouched and restored it), and mine attracted some downvotes.
I'm surprised to see that in this thread. That's usually reserved for politics and arguments about AI.
Could be general polarisation, or just that it's a "but in my case it is different" visceral response.
While people might not be moved by data, it would be interesting if some more public information on what people actually use was available. Imagine data points like unpatched/unpatchable iOS or Android devices being multiple percentages, or outdated browsers. Similarly, the effort per app/OS combination; if it costs X to support Y configuration, then it would be somewhat easier to see if it's more about the will to do anything rather than real-world problems.
There's five banking apps that support it specifically listed here [1]. I guess the dozen is not listed somewhere. Roblox, Hyundai, and Kia are also apps that officially support GrapheneOS. We should note that not all that are supporting it are using attestation.
I find all the people complaining about this to be rather insane. This is a completely open source linux distro getting official support from banks, some of the most legacy companies of all. This is good news. If companies are open-minded enough to support GrapheneOS, they're gonna be much more likely to also officially support other secure operating systems that are open source.
These are banking apps that weren't previously possible to be used on GrapheneOS. We're going from zero to one, not a step back.
[1] https://github.com/PrivSec-dev/banking-apps-compat-report/is...
GrapheneOS isn't a Linux distro it's an AOSP distro
Hm, what's the definition of works? https://github.com/PrivSec-dev/banking-apps-compat-report/is... - closed without a fix for Zelle. Another user later opened a ticket about Zelle not working, and it got closed as a dupe of the first, which had been closed 2-3 years earlier. Not promising.
> many have memory corruption bugs and incorrect anti-tampering code requiring our per-app exploit protection compatibility mode toggle
Ironic for apps that are often so paranoid about "security" and "hardware attestation"
Because it’s mostly about checking compliance boxes than really caring about security.
Corporation are not able to "care". It's the boxes's fault. That is, legislation and/or enforcement.
By that logic governments are not able to "care" either.
But both are examples of cybernetic entities, if they don't care then their control loops aren't correctly aligned.
This meme again? Corporations are not capable of anything, but corporations are made of people, and people can care.
Call me cynical, but I would rather rely on written regulations and systems of checks than human altruism.
True. Those who only care about meeting regulatory requirements are not going to care if the regulatory requirements cease to exist. Those who care about security may be dismissive of regulatory requirements, but they will do so primarily when they are insufficient or when they conflict with their opinion. In the former case, they probably have the ability to go beyond the regulatory requirements. In the latter case: while I won't claim that regulations are perfect, I would trust them over the an anonymous person who may be going on anything from their personal opinion to legitimate research.
Currently, besides if you use cryptocurrencies, I don't think you can rely solely on "written regulations and systems of checks", somewhere along those processes there are a bunch of humans with their altruism (or lack of), taste and daily life moving those processes along. And judging by the state of the cryptocurrency ecosystem, this is probably a good thing more than a bad thing.
We need a graph of empathy vs number of people in organization
Lmao, it's never legislation and/or enforcement. It's the checkboxes that their insurances told them they had to check or they wouldn't be covered. Half of the problem goes back to insurances being thieves who would do anything to not pay up, the other half goes to upper management not giving a shit about people.
Yep. I used to work for an FQHC, and the only thing that improved our network security was the insurance premiums we'd incur without proving compliance. Ofc course, HIPAA is a thing, but that was simply the baseline.
Its not like govt agencies care about security either. Its just "compliance" bs. Most european eID stuff works like that.
In my experience, banks are among the worst at following email standards. Why would we expect more sophisticated security protections from them?
This post is awful, the link posted here is to a social media reply and even that reply does not contain a list of the 12 banks, it does however contain a link to a much larger list of banks, which are supported but not necessarily officially supported.
I have avoided grapheneos.social links on HN just like quanta magazine ones.
Let's hope your comment won't summon Daniel Micay to this thread once it's daytime in NA, dropping 10000-character comments on why all of us are wrong, flanked by his alt-accounts validating his every point and gaslighting whoever argues with him.
If you have evidence that someone is using fake accounts, you should email that to the mods. I will agree with the rest of your comment though.
Go touch grass, what sort of positive beneficial value does this add to any conversation.
Your type make HackerNews more like Mumsnet full of feminine energy, gossip and character assassination avoiding a single logical thought or adding anything of technical value.
This asinine nonsense is like reading a 14 year old girls diary. Grow up.(And before you think going after my feels will help it won't chick, I know the above after laughing with my wife when we went back to hers.)
And if I decide to patch my OS to fix some annoyance, then what?
Thanks, but no thanks. Remote attestation is simply not acceptable. You use it, I won't use your app.
> banking apps began specifically permitting GrapheneOS
In my view, that's not any better than specifically permitting Google only. This should not be a whitelist at all. I assume my self-signed GrapheneOS would fail this test?
Any idea which banks support “tap to pay”. Usually on Android or iPhone users access Googld pay or Apple Pay.
Word is that banking apps that implement their own nfc interface within their app can be used for “tap to pay” on Graphene.
Curious as to how we can know which providers support this.
In Germany Sparda-Banken and, I think, Volks- und Raiffeisenbanken support tap-to-pay through their apps. (And maybe other banks providing apps developed by the same contractor, Atruvia AG.)
PayPal also offers tap-to-pay, though I recently had to disable Graphene's "secure app spawning" feature for the PayPal app to get it to open.
Curve in Europe (which can be linked to any card) and Paypal.
Curve has been requiring Google Services for months now it seems. Tried to get the thing working on my GrapheneOS the app won't start without them.
I have failed to get Curve running after installing GrapheneOS on a new device.
Ah ok fair, if your GrapheneOS isn't running the sandboxed google play services, not even in a separate profile, then I don't know if it works.
I wonder how many of these supported apps are supported, because there are some geeks on the inside of the banks who want to have their favorite mobile OS supported.
Very few, unless this geek is a CTO, which is very unlikely.
Why not just use a web app from laptop at home? Why do you even need an app on your phone? So that you can urgently transfer money to some scammers you met in the street?
I do not have any banking apps, and I log into a bank account maybe once in month or less often.
Agreed that a website should be fine, but (Dutch) banks require the app as a second factor to log into the website. Fido2 hardware tokens could replace the bullshit requirement of "choose Apple or Google to be your overlord in order to use our service".
Ehm, no. They don’t all do at least. For one, Rabobank does not require it. You can use the app to authorize in the browser. But for big transfers you still need their Rabo Scanner (which you get the first one of for free).
We use SMS OTP as a second factor. Although banks of course want to save some cents and use push notifications for those who has a mobile app.
SMS OTP is not very secure relative to a push notification to an app
I think EU regulation kind of force the banks into app usage as 2nd factor
Unfortunately the only way I can spend directly from my work-sponsored FSA account is if I download their app. I haven't, since I can still just submit receipts, but they won't send you a physical card.
A lot of banks are dropping support for making transfers from their regular webapp. AFAIK, in some countries a total of zero banks support this.
In Russia, all banks I tried, are usable via web app (because smartphone apps live only 1-2 months before they are detected and removed from app stores). The disadvantage of a web app is that it is not always-on, doesn't allow tracking users are well as a real app, and cannot display advertisement notifications.
The list is here:
https://privsec.dev/posts/android/banking-applications-compa...
Looks like good progress to me.
Mine (KH bank) does perform a safetynet attestation that fails, as I don't even pass basicintegrity, then proceeds to completely ignore the result and still let me in on GOS.
I wonder if it's intentional.
Weird, you should pass the basic and fail the remaining two:
https://play.google.com/store/apps/details?id=gr.nikolasspyr...
(FWIW, sometimes when you _block_ the app from the Play Integrity API (in this pop-up) the app that wants to perform the check works, while it fails when you do not block it)
I'm not logged in to any google account and get apps through aurora. I read somewhere that could be the reason.
A better link to the actual list of hundreds of banking apps supported
https://privsec.dev/posts/android/banking-applications-compa...
I always have to roll my eyes when someone tells me they consult for banks like that's supposed to be impressive.
That crowd thinks 12 Factor applications are some monumental thing, "oh no, we can't do that, we would have to hire only the most expert experts, nobody does 12 Factor applications". They're all Windows tards.
Then as highlighted the other day, the big banks, including LLoyds, all run on Google's Cloud because ding ding ding big surprise they couldn't figure it out themselves, and they didn't deploy multi-AZ. They didn't do a rudimentary thing that virtually every startup knows to do and does.
The banks and the clowns that surround them are, by today's standards, barely computer literate.
Why not lineageos23?
what's the point of having grapheneOS and then installing all the google spyware back?
all these reports assume user installed google play store and google services.
this is like installing linux, then wine, then all the windows bloatware back.
It's properly sandboxed, which is a lot better than Google Play Services on regular Android. Far from ideal of course, but I assume GrapheneOS is built with those people in mind for whom Google is unavoidable.
Why is the title "a dozen", when the link given in the post covers hundreds of banks that support it?
A dozen is the number of banks that whitelist Grapheneos keys via hardware attestation.
This post is actually really bad for a Hn post, it appears to be a reply to someone else hence the lack of context here, and the link appears to be a list of banking apps that are have some level of compatibility at all, not the official 12.
I didn't have time to review it, but there is some way to explicitly trust GrapheneOS. Maybe that is what they mean?
Very good news. It's a good sign if banking companies are considering the actual security issues at play and not just blindly rejecting all unofficial ROMs.
I truly hope that this is not a pure whitelist of only the official signing keys via attestation.
it is
Excellent. That was one of my main issues with Graphene.
I'm just starting a deep-dive on it.
As a newbie, can existing users point out any other gotchas?
* EDIT: Oh ffs, only on Pixel phones ...
It's not Pixel only for no reason, there aren't any other phones which meet the rather sensible requirements at this moment. And even the latest Pixel phones have regressed.
Thanks for the heads up. Will wait for the Moto reboot! Hopefully this becomes more of a thing.
Complain to other hardware vendors that they sell insecure crap or do not release updates :/
And yeah, it'll be Motorola from the next year on, but a proper, first party cooperation. I think that Motorola wants to become the answer to the question: "what's the best, safest android smartphone?"
Coming to a Motorola flagship next year!
Thanks for the heads up!!!
I'm a previous Moto user and despite Pixel supposedly being more advanced, I really disliked them. I always preferred the Moto phones.
Gives me hope!
Good. I am tired of vendor-lock-in of a few corporations dominating the world here. Capitalism was never corporate-fascism - after all one element is free competition in a free market. This has been broken numerous times again and again, and the US justice department is deliberately unwilling to remedy this situation - thus also betraying the idea behind capitalism. No wonder since the orange mafia is running the show right now, with all signs of real dementia now being obvious.
Capitalism was never the same as free-market. In a free market there's competition, but in capital-ism it's all centralised at a few people, the ones who have all the capital.
Is this new? It's unclear why the word "began" is in the title
After that guy was arrested for wiping his GrapheneOS phone with a duress password, some reports appeared of previously usable apps becoming unusable specifically on GrapheneOS. This now reads like a possible reversal of that trend.
Where is this list of 12+ banks that explicitly allow graphene. My understanding is if the banks do not explicitly state support also in terms of ToS, they might pull the rug any moment. With neo banks you are then basically left without a bank.
I found some evidence of half a dozen that there might be support 'by desogn' (all of them might pull the rug at any time again as far as I understand TOS, which however seems true for any android in theory): Swissquote, Yuh, UBS, Starling Bank, Triodos Bankieren NL, AmeriCU Credit Union. More?
That sentence is lifted from the post.