SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
Don't think this would work as well as you think it would. One of the privileges of being an executive is that you basically have unlimited access to money so their kids are playing roblox on ipads (each kid has their own).
It reminds me of this time I learned for the first time about heated driveways so I was talking to my coworker and friend about how if I was a multimillionaire, I would have one of those things and I would never have to shovel snow again. He replied by saying I don't understand how being a multimillionaire works.
A simple millionaire hires people to shovel snow. A multi-millionaire doesn't even think about such trivialities as snow, because their assistant has a budget and proactively makes sure the property is always taken care of. (Or more likely, they live somewhere where it never snows anyway.)
Oh, the horror! The digital pacifier does not work on this weird cheap phone
Normies don't understand the that any computer should be able to run software from any other computer. They dont get the idea of the general purpose computer. They've bought into the idea of computers-as-appliances sold by steve jobs and others.
The executives you're talking about don't see an issue with this. Their solution for this is the same as everything else: spend more money and buy another device. User freedom does not even enter the equation.
Yes, and it's even worse than that. Phone, tablet, TV box manufacturers now routinely lock the bootloader of the devices they make. This means that even if you are willing to sacrifice device attestion for the sake of freedom, you can't replace the firmware/OS, unless some exploit or other workaround is found. These corporations treat the device as a storefront from which to extract additional revenue and spy on their customers for their benefit. It's truly shocking, and Apple convinced normies that it's normal.
If they identify as a normie or an appliance peddler who is offended by the tone suggesting computers "should" be general purpose?
Or they are offended by the implication that said normies are perhaps unable to understand this lost potential, rather than making principled choices to embrace the appliance shlock?
I believe the fit is so poor that google should really object to it. I already refuse to make youtube videos because I need my gmail account.[1] If I need my google account for my ID and my payments I cant use gmail.[2] I also don't need Google ads badly enough.
It doesn't take a lot of stupid to lose the account but ANY account activity at all may trigger false positives.
In theory the US government can seize EU google accounts. Given time I'm sure we can find even crazier rulers than Ursula and Donald combined.
[1] - I got one flag for a 10 min video including 10 sec of 1991 footage from a local NZ news agency credited both in the video and linked in the description.
[2] - I've already lost my account once temporarily for jokingly hitting reply-all without looking how many cc's there were.
> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.
There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.
Because these API are not meant to be public for the end user to use.
Access to that kind of data requires regulation, a lot of it and that's why Third Party Providers exist. There are a lot of them in Europe and they're not expensive.
I actually didn't expect to find anything about bunq around here but I have to say they're the worst bank I've worked with. When we started working with them, their API were broken and the devs had no idea why. It seems to have improved recently but it's definitely not a bank to praise for their API.
Bunq… It’s great that they have an API, but to use it, I had to clone their SDK, and manually fix everything that was broken, add some workarounds, and now it works. Documentation was all from the announcement in 2016, me using it was ~2022, and some undocumented things changed since. Still, better than no API, which is what everyone else seems to offer.
And now we have a paypal-like shopping experience via SEPA Instant Payments, all our PayPal hating customers are happy ;)
> Because these API are not meant to be public for the end user to use.
I know, that's my point. It's a stupid decision.
> Access to that kind of data requires regulation
It's my data. I want to access it how I see fit.
> There are a lot of them in Europe and they're not expensive.
I already have a bank and I already pay them. I don't want to pay anyone else to be able to use my bank account in a way that suits me. Sadly, there aren't many good options.
Someone mentioned Wise, and they do seem pretty interesting. But it makes no sense why common high strees banks refuse to cater to power users, or even to users who aren't using mainstream devices.
It ain't your data, it's the bank's data about you. Banks are shitty about access, APIs because they are perpetually in CYA mode from KYC/AML rules from the US (also on most foreign banks) and GDPR and cousins in Europe.
I was actually surprised how many bank apps will work under GrapheneOS even if only partially.
Whilst not PSD2/PSD3, I've been super happy with Wise; an excellent API, good quality docs. A _proper_ test environment that you can drive using hooks they expose. Nothing but praise for them, including their support, which has helped me around the clock even on weird questions such as why my custom integration fails to send a transaction (mismatched currency between recipient and transfer in my code).
Not going to be a good day when Wise or Plaid are breached and accounts start being drained. Adding middlemen is not a solution to poor banking services.
In Hungary you don't get documentation for these APIs only in pdfs via email, and if you get it the APIs are not stable, constantly breaking. I was always dreaming about creating an automated testing suite and report all of the issues automatically to the national bank, which is the supervisor of all commercial banks in HU, in a hope to punish them.
Seriously, count your blessings man. In America we only get Plaid, which only works right or reliably for big banks (which are also the worst ones), and it isn’t an API for humans, just a paid SaaS product that a company who wants to offer integration with banks has to pay (i assume a lot) for.
> "Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful
You mean the step from sandbox to production application, or you're not even getting access to the sandbox itself? I managed to get sandbox access with ease via two separate banks (both Spanish though), with no problems, think it took them one (working) day or something to review my "application". I never tried to get anything into the production environments though, but makes sense they'd be a bit tighter on that tbh.
Not sure why you'd claim it's impossible, it's in wide use already by banks, fintech and payment service providers across the union.
Why would banks be motivated to care? People just give them money as a business model. Up until recently, Wells Fargo didnt have case sensitive passwords even, because no pressure to do anything about that.
To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.
They are breaking the law, that should be motivation enough. That the number of non android non ios users is small shouldn't be relevant. The locked down android and apple devices are like virtual US soil. The obligation should be to service all EU citizens rather than a sub set.
>> People just give them money as a business model.
You dont actually give them money...you loan them money when you do a deposit. That is why they pay you interest, and that comes with the risk of loans to another party.
A little detail they are happy to omit and they are happy to let people talk about: "I have money in the bank", that you of course ...dont have.
Incorrect-ish. 12 U.S.C. § 1821(f)(1) states that payment shall be made by the FDIC "as soon as possible," but as my sister-the-lawyer has always been at pains to point out to me, the most up-to-date specific language is from 2016's 81 Federal Register 87734, 87735, section B, which explicitly states that they "[do] not specify a time period for paying insured depositors." In other words, if it's a tiny bank failure you might get lucky and get made whole in a few business days, but if it's something larger, they can choose to meet their regulatory obligations over the course of decades - which is very much real risk.
This particular insurer is unlike others because it can ultimately edit entries in a database whenever it wants. As long as you are part of the group that is considered worth editing the database for, such as a depositor at one of the too-big-to-fail banks, then you have nothing to worry about.
This is a thread about a EU bank, and banks in the EU both have some standard interest rate on savings accounts, and moreover might offer time-restricted savings accounts with an even higher rate. That said, they track poorly with inflation compared to actual investment.
Zero is also a number, although not all Mathematicians accept that. 0% interest does not change the essence of the monetary relationship with your bank, or the risk profile.
Technically true I suppose. But go ask the average person on the street where the bank gets the money they lend people for mortgages and cars and such and I guarantee you the number of people that make that connection is going to be much much smaller than you seem to want to suggest.
It doesn't actually work the way it's portrayed in It's a Wonderful Life. The banks don't use depositor money to make loans. I suspect you will think what they actually do is even worse. Look into fractional reserve banking.
Never seen that movie but did watch a documentary ages ago about fractional reserve banking yes.
The bank still uses the deposit money in that system. You are right to point out those same people on the street I mentioned would freak out even more if they knew that banks essentially lend out more than we deposited and also that they might sell your debt and all that jazz (I bet most people either never understood what happened in 2008 or forgot already other than a vague "yeah mortgage crisis")
And you don't think that plays some part in all these arcane security requirements that basically amount to "you're doing something a little weird so we're just going to block you rather than support it"?
Unfortunately, banks can be held liable for customers getting scammed. Even if they win in the end, they have to make the customer whole first no matter what [1].
Banks are motivated to care, but in the direction they currently do. They can be on the hook for making up losses. Whether you as an ultra leet hax0r can run rooted/jailbroken devices without getting owned, they are worried about your non-leet parents doing the same and having their retirement accounts drained by North Korea. I know it sounds far fetched, but it is a plausible scenario that I heard recently
The same banks that typically embrace the 3 biggest signs of security stupidity:
- max length of passwords (not talking about lengths that would pose a DoS threat, talking limits like 20 characters)
- incredibly constrained character set for passwords (“your password can’t contain a quotation mark, only alphanumeric and these specific 10 punctuation marks”)
- “security” questions (can we just ban these already? Knowing that my childhood dog’s name was Bingo should NOT give you the ability to change my brokerage password.)
> But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.
Same reason why media companies spend millions on DRM that delays the pirates by 0 days. Checklist-driven "security", CYA and out of touch executives calling the shots.
Did the higher ups want more effort to be spent on "security"? Yes. Is there any way to actually add "more security" to the setup? No. Could not doing anything in face of direct orders from the above be bad for your career? Yes. So random bullshit go.
It's not like the bank client developers are even implementing any of it themselves. They buy someone else's middleware and hopefully don't misconfigure it when they cram it into their builds.
I'm convinced the Amazon Fire Phone was the motivation for SafetyNet.
The Fire Phone was a midrange Android phone from 2014 preloaded with Amazon's app store and services instead of Google's. It failed on its own merits, but I think Google got scared someone else would do a better job. The barrier to entry is a lot higher if most people can't use their banking app on it.
More it was the banks were made liable for stolen funds. So they responded by making funds harder to steal.
Do you really think banks care about you installing custom themes or whatever? They only care because the cracked Spotify app also has malware bundled on the side which uses the new root access to break the app sandboxes.
I also consider restrictions against open source
to be malicious acts - hence also malware, such
as by banks and other companies. Or, worse,
government agencies. In a local medical university
in central Europe, for instance, we are required
to either have a Google account or a Microsoft
account - usually the latter, to access emails.
Yeah, you’re right man. The bank is just hell bent on stopping you from using GrapheneOS just because they’re in the pocket of Big Google or whatever. It’s gotta be malice. It’s not about liability at all.
Mostly the government forces them to do this. If the capability did not exist it wouldn't be mandated or used. Think about this whenever someone tells you "just don't use it if you don't like it", about everything.
EU has PSD2 which enforce good, strong rules on customer authentication. For example, banks must have two-factor authentication. And if both factors live on the same phone, the bank has to safeguard against that phone being compromised. Hence the root detection and app-integrity checks that he is complaining about.
But what's tragic is that instead of understanding the problem, which is partly driven by regulation and mostly not even a problem, he calls for more government regulation. What a mess.
The issue is weird. Banking is both conservative and on the lookout for new way to make things complicated, but one dumb executive --usually-- can't derail the entire bank, because there are enough stops in place. This is one of the reasons US banking is such a ridiculous mix of various integrations of a line of executive decisions resulting indirectly from lunches with said executives.
I don't know if there is a common API standard from a technical point of view, but there is the legal framework for it. Banks in the the EU have to provide an access to third parties who provide account information services to clients (themselves being regulated and supervised by a national agency). I would assume because it is mandatory, it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which always include all of the user hostile bullshit you mentioned.
It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/
The only way this can NOT happen is if someone quite senior signs off on the risk, who would have to get in a big fight with the cyber/policy teams for basically no benefit to themselves. They would also have to be unusually technical and pro freedom to even understand the issues, which is not the typical personality profile of the kind of executive who ends up with overall risk authority for a bank's mobile app.
yeah, there are a lot of bad auditors in all kinds of ways, mostly:
- auditors which commonly "pass" things which should be flagged, but happen to be a more expensive then normal industry standard in ways which should make them non-competive but somehow they get hired a lot
- auditors which flag nonsense and don't understand anything about security at all
some of the "security frameworks" which are applied by default makes a lot assumptions about how software is build/structured/works _based on what was common in the 90th_, and they don't even list their own assumptions... Luckily they are a base line you can perfectly fulfill but still a pain.
Like e.g. a session key having 128bit entropy is a reasonable minimum, but then imagine the framework assumes the session key & session id are the same because some 90th software did so and now requires you session ids to have 128bit entropy, but e.g. UUIDv4 has only 122bit entropy and a UUID being used is deeply integrated into middle-ware you use and can't be changed... (And having a session id=session key setup is anyway a bad idea as it means you mustn't log the session id anymore, but you also might have requirements which do require logging session ids in audit logs and similar).
This isn't even the most nonsensical thing I had ran into, just one I remember well. There where rules based on assumptions of you uploading files into a file system _using the upload file name_ while interleaving security sensitive web-server config files with uploaded directories ... like yes I know some software did so in the past but the rule should be "your software musn't do such a negligent thing" and not "you software must do this 5 extra steps in case it maybe does that insane negligent thing"
Instead of asking the government to fit all banks' products to your preferences, you could just use a bank that fits your preferences.
I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).
> you could just use a bank that fits your preferences.
you assume this exists / can exist
(for a given set of reasonable requirements which aren't yours)
but various "practices" and "regulations" for software security push banks into the direction of such nonsense, so if a major reasons this is happening is the government asking them to fix it is very reasonable
similar in other context where that argument is often used you have problems like monopolies, collusive agreements or various source pushing companies into acting collectively user hostile weather it's laws or other reasons
the government fixing such things by changing laws/regulations is pretty much the only things which can work in many cases
this doesn't mean they have to tell companies exactly what to do, instead they (should) find out what pushes things in bad directions and then "counter balance it" in some form or way
> banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it"
Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.
Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.
> forces banks to provide access through a common API standard
I think this is good actually. We have taken the convenience vs security trade off too much towards the former either because or due to how busy and intense life is nowadays. Waiting 4hr to make a big purchase should almost never be a problem.
No, the banking system just runs so perennially behind the times that they suffer from baroque issues that no one else has had in 20 years.
Eg the above example; how is it possible to send money without knowing who the other side is? I can trivially look up a domain name and see registration info, I can look up the IP to see who it’s registered to, I can check certs to see if they’re valid and legit.
It’s bizarre how normal we think it is to send large sums to random strings of digits that we think are Amazon or the IRS with basically 0 way to validate them.
I bought a house in cash and putting the money in escrow was unbelievably stressful. They send me numbers, on a printout that’s a scan of a scan of a scan with text that says “call to make sure this is still the right account number”, and a bajillion warnings to make sure the number is right or vague and terrible things might happen.
Insanity that I can get insanely complicated gadgets shipped to my house in 4 hours but we don’t have a better way to move 6 figure sums than “double check your numbers”.
In Finland at least there’s now recipient (name) verification, so it absolutely can be done. When you transfer money to someone, it will check your input against the true account holder and will warn if they don’t match. You can ignore the warning at your own peril.
That seems like a big regression versus a paper check. With a check I can “spend” the money immediately, or at least commit to spending it. It isn’t deducted until the check clears (which is a pain) but I don’t have to wait around for 4 hours apologizing to the seller until I’m allowed to transfer my own money.
This reads like you’ve never made a large purchase outside of the internet. I don’t know why you’d advocate for this except to be contrarian.
I recently had a family member with a medical emergency in a foreign country with only 1 direct flight to cross an ocean, and there was a narrow window of time to buy the very limited supply of lie flat seats needed to make the trip so medical care could be resumed as quickly as possible.
It was nice to be able to spend $30k+ on short notice. With modern security features, there is no need to enforce an arbitrary time limit if the payer accepts the risks.
What exactly do you mean by sending that $30k at your own risk? Like are you suggesting if you sent it to the wrong entity (say they turned out to be a scammer) and the bank shrugged, you'd be fine with it because you took the risk? If yes, do you think most people would? I feel like most people expect more safeguards and recourse when the transaction amount is higher, not less.
Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
You mean like HTTPS? It's a shame that mobile banking website have fallen out of favor.
I'd really love to see your banking app that works differently and cannot super trivially be attacked by malicious software. Can you show us your example of such an app? It might be helpful to show tha validity of your arguments.
There is bunq, which offers a full API for regular users, including a web hook call in case of new transactions. Made me actually switch to them. Super nice so far.
Exactly, it's an utterly ludicrous state of affairs that I'd have to give access to a third party to my freaking bank details. And this is treated as some kind of success?
One of my agents has (read only) access to my accounts. I do it via Era, which is quite good, though expensive (they try to justify this with other functionality, but they provide nothing my agent can't do itself other than the API access).
To provide me with API access to my own accounts, Era goes through another third party provider which again connects to my bank. I guess they could eventually get direct connections themselves.
So instead of me get convenient read-only access to my bank, I've ended up giving two separate third party providers credentials I'd prefer they didn't have.
All I'd need was an automated way to get a CSV or JSON dump of my transactions and I'd have been happy, but none of my banks support that without manually logging in. It's infuriating.
Open banking isn’t mandatory. Psd2 and successors are. But it does not require the banks to expose feature parity APIs so others can replicate their apps.
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
People need to stop calling for the EU "to step in", they already have and made everything worse. They forced PSD2 with """"""""""""""Open Banking""""""""""""""" which requires convoluted requirements and is regulated to death so no private person can call the API themselves and get e.g. their balance or transactions.
I like complaining about it too, but it's still a massive step forward from how things were before, where I had no access. Now I at least have access even if it involves going via third parties.
How is that worse? It's only "open" in the sense that other licensed businesses can provide services that integrate with your bank account, but it didn't take anything away.
I saw my bank embedding a keylogger and it was even scrapping the password entered to login and basically slurping everything done on the page to an external domain. I checked with the bank and they said these were their analytics and nothing to worry...
I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.
I'm not saying that crypto currencies are the solution to everything wrong with the banking system, but if you have crypto at Binance you do in fact not own any crypto at all and are literally using them as a bank, just an unregulated one. You get the worst of both worlds.
When you actually own your crypto currencies because you have the keys Binance cannot give away your money to North Koreans.
SafetyNet indeed was and it was not a mistake. Mistakes are bugs, a company doing things they didn't want to do, or didn't intend to have the effect it later had.
Banks on the other hand, as much as hateable (most of them are), also just shit bricks at mere thought of one regulatory spanking, not only hammering from their boards and shareholders (esp. the major ones). So – it might be a great idea to not shit on banks shitting on such choices.
Banks are also sacred of making changes and going farther from the "mainstream" and another reason is also because - they handle "real money", often people's entire life-savings.
We just think:
… oh, this OS is soo cool, so safe, let's use this.
… And then notice: goodness, this motherfucking company is not letting me use their app on this coolest and safest shit out there. Burn them!
And banks think:
… shit this one is not part of any common industry standards, let's stay the fuck away from it.
… Further: ha, authorities don't look kindly on this OS, let's stay extra away from it.
… And more: will this mean we have to support one more standard, one more release channel, one more modified OS? Anyone who mentions name of this OS again will thrown out of the window of highest floor of our HQ (and mind it, we are on 33rd already).
Solution (one of the) is forcing Googles and Apples to stay open, to stay respectful of user privacy in an absolute and transparent manner, to not let them implement closed-off protocols, to have APIs that is not availalbe to everyone – in a safe manner, not let them (and the politicians and security agencies) fear-monger the public like "think of the children" etc. Blaming banks is literally barking up the wrong tree – esp. in this context.
Another way is: not buying these devices and suffer the pain (and experience the bliss, yes!) and then hope/work for this number to increase and collectively point a thick and long shimmering hot rod (metamorphically speaking) at the hinds of such companies (hell, include the banks as well – so that they won't fuck up their desktop and mobile portals) so that they collectively feel the heat and are forced to bend (no metaphors here!). But no, we won't let go of our annual pleasure of this practically bullshit <First Time on an X>™ orgasms.
tl;dr: SafetyNet was not a mistake, making something like SafetyNet into the monster it and then making it limited to one company/one publisher (esp. since they are the ones who also control the OS) was the mistake. I think of this to be solveable sometnhing on the lines of multiple certificate issuers (but we have to be careful of eMudhras) - both for safetynets, and app stores (if not combined).
Safetynet was not a mistake; it was a lock-in mechanism. Widespread failure to call it out as such and oppose it as happened when Microsoft proposed something similar for PCs a decade earlier[0] was the mistake.
> will this mean we have to support one more standard, one more release channel, one more modified OS?
Android apps don't have to take any active steps to support third-party distributions. All they have to do is refrain from taking active stops to block them, but I suspect you knew that.
Nah SafetyNet offloaded a huge chunk of security on Android from app makers to Google/AOSP, it's an excellent system that works great for 99.99% of uses. It's what allows safe and fast banking on Android in general.
An immutable OS install and app sandboxing by default provide a lot of security. Those are present on third-party Android distributions that don't pass SafetyNet. Some users of those add root access so they can let a handful of apps out of the sandbox, but I'm willing to bet most of those are tech experts with better security habits than the average person.
Show me examples of actual data breaches and account takeovers SafetyNet would have stopped if you really want to defend this position.
It's an excellent system that forbids up-to-date open source systems, but is completely ok with systems that are several years behind in security patches.
It's just a way for app makers to point their finger at someone else.
It's a system that allows even those old systems to still use banking reliably and securely, so yeah I'd say it's an excellent system. As far as GrapheneOS goes - now that they're partnered with Motorola they might actually get some certification, along with a proper security audit from Google. Not sure what the details of the supported functionality are gonna be there.
Older Android phones that haven't received security updates for two years are not secure. The Play Integrity check therefore does not mean that the phone is secure, but only that it is a certified smartphone that came with Google services preinstalled.
> It's a system that allows even those old systems to still use banking reliably and securely
This is the crux of your entire argument, so you kind of need to actually substantiate it. Does Play Integrity catch an app from to Play Store using an exploit against a comically ancient vendor kernel to do anything it wants? How?
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Most European banks either don't have a web banking at all, or require a mobile app to log into it. There are exceptions but they are rare and becoming even rarer.
In Thailand pretty much all of the banks are shutting down their websites. App only, typically requiring visiting a branch to register the app on your phone, blocking screenshots, and often blocking vpn or 1.1.1.1 access. :-(
Well that's not really true. There's most definitely functionality that is only available in the app. If I want to make a payment without having to dig a card reader out every single time, I absolutely have to use my bank's app.
> "Well that's not really true. There's most definitely functionality that is only available in the app. If I want to make a payment without having to dig a card reader out every single time, I absolutely have to use my bank's app."
Maybe not for you, but you don't know his bank. Obviously I can't pay with my phone if I sit at my computer and use online banking in browser, so obviously payment with phone app won't work if I use browser on phone, for all other online banking functionality there is no benefit in the app, all of my 3 banks I regularly use don't require any card reader or even smartphone, all I need is any phone being able to receive SMS with 2FA codes, if my bank required app to use online banking I would just stop using their services. I am not going to bother with app in the phone while sitting at computer with 32" display and proper keyboard.
The parent commenter was implying anyone can just go to their banks website, I'm pointing out that in the case of my bank there is valuable functionality locked in the app and I'm sure it's not the only one.
There are no reasonable banks to switch to that have a website. The last good one got bought up in 2022. All the ones that are left have been a horrible experience to use.
I've used smile since 2004. It has an app which is fine, or I use the webpage which has more choice. I used HSBC before then which had a web interface, I vaguely remember natwest had special software for computer banking in the 90s, that might have been business accounts only, and potentially even was dialing direct to their systems rather than via the internet.
There are app only banks, you make your choice and you pay your price.
My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years...
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess? Not how I'd architect it...
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
> The Rabobank app works fine on Android phones that haven't seen updates in years...
Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.
They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated. Another thing is actually supportability. Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.
Now, that isn't to say there aren't security issues, nor that QA is perfect on devices they do support (like with any enterprise software projects), but it is a valid reason from a business perspective to not support everything.
Why do you think generally OpenBSD and such platforms aren't supported by commercial software, nor most open-source software? It adds a lot of burden for testing and QA on developers who will need to become intricately familiar with yet another platform.
People stare blindly at some customer support answers and hinge everything on those words, but if you think carefully about how software, compatibility and support work, this all makes perfect sense.
> They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated.
Hardly true, if they permitted Lineage and so on.
> Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.
Not really, there are a myriad of devices and they're not testing on all of them. A "pound sand if you're on an unsupported device and it isn't working" policy would be perfectly acceptable, as long as the issue isn't directly caused by the developer purposefully breaking the application for a subset of users that fail Play Protect check or whatever.
I'm sure they're completely unbiased source. But seriously, the real question is whether lineage is more or less secure than the stock ROMs that are currently allowed.
This bank claims "security is very important to them". In another, the poster reports getting training spam every week.
Installing Lineage isn't that hard. If they're going to badly inconvenience some customers / force hardware purchases, why not start with the ones who are most likely to get their accounts drained?
If any of what you were saying were true, then this wouldn't be just a discussion about banking software all the time, and we would see it happen with all kinds of other software, scaling with the complexity of the application or the level of provided customer support or the intended sophistication of the user or how "enterprise" the target market sounds... but none of this is the case, and if you tried to cluster products that do this along some axes the ones that stick out like a sore thumb are all of the form "controls something sensitive": money (banking, payments, investing, etc.), health data, copyrighted media (streaming), and multiplayer gaming (due to cheating issues). All of these people are very open about why they think they do it, and while we know they are incompetent, they are not doing it to be malicious and they have no incentive to lie to you about this: if a bank were truly not supporting your device because it was rare, they'd just say it, and we have ample evidence of this from banks choosing to not support "niche" browsers (including an era of "anything other than IE6" omg ;P). So: "cool story bro", but it is clearly wrong, lol.
It's not about your security nor your account. They are protecting their app, their apis, their servers. Everything that makes the life more complicated for hackers will be deployed, even if that includes power-users hacking their own stuff.
Blocking people from rooting their own devices isn't meaningfully contributing to security, even if they think it is. Not relying on security through obscurity is one of the first things you learn when studying the subject.
Not relying on security through obscurity doesn't mean obscuring things is bad for security, it just means this is not sufficient. Relying only on this or getting a false sense of security due to this would be bad.
For Google control is the issue (and the data flowing with it), not security, and once again we in Europe just swallow that shit and mess up our supposed "open" standards. In this case it really is because there are no competent people making these decisions. They just trust Google when they say: "It's for security".
I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the US and YOU are throwing YOUR privacy conscious users under the bus, because you do not fully understand the forces at play.
> It's not, it's more about sovereignty and control
The bank doesn't care about either. It cares about the risks, costs and opinion of the regulator on how well it evaluates and controls those risks.
If risks can be transferred to an external party and DNB signs on it, sure. If DNB says reliance on this specific external party is a risk in itself, then sure, there will be a plan for that too. The plan could be "if google becomes a problem we can publish a new version of the app using grapheneos attestation anchors in N weeks"
Of course they pass system integrity. The whole point of the thing is not "it should be secure", it's "the user has not messed with it so we control it".
If the device is "insecure", doesn't that mean you - as a user - can exploit one of those insecurities to "mess with" the device without system integrity being aware?
Or are you saying the device is insecure BUT has no local privilege escalations you can take advantage of as a user?
It could have RCE but not privilige escalation. But I don't buy it, because 5 years without kernel patches is at least 5 escalation exploits being written by the an llm in 5 minutes
Well, yes? The law says that the bank should do the thing and the bank does the thing to the best of it's ability, given what people usually work there.
Oh, you have no idea. It's not even about costs. In a 200 year old company the level of corporate disfunction and the average skill level of people is something else entirely. Nothing ever happens unless the regulator holds a blowtorch wired to a timer to the CEO's ass.
Walt looks great. Though I'm not sure I'd trust my financials to a service that posts "Launch dat shit" as a milestone in their roadmap on their homepage.
I actually love that about it. Look at those photo's, what a guy. Contrast this to some "pro" looking vibe coded website, I'll take that guy launching dat shit over that any day.
Why do we trust soulless orgs? Trust this dude who puts his own face on his product!
I'd like to use this moment to praise ING. I have an old tablet running quite modern LinageOS. The ROM is rooted and I use apps that require root accounts. Its almsot only purpose is banking. I don't have banking apps on my main phone.
I have ING app installed on the tablet, the only issues the bank has with it is I get more notifications wanting me to do online training on cyber security or being scammed. I get the same notification every few weeks that my device is rooted and it is "potentially more vulnerable", I can click "I understand" or "Learn more". No other issues, it's not blocking me from doing anything, not forcing any updates, doesn't limit any functionality of the app. Despite my salary is not paid to ING, ING is my main bank. Monzo UK didn't allow me to run on LinageOS on a tablet, Revolut isn't available on tablets at all.
In Holland, GrapheneOS users are being targeted by police after "busting" a re-seller. The owners of the phones got raided without them being involved in any investigation. Just having the phone was enough to get a knock.
Supposedly the Dutch police had "cracked" their phones.
According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.
His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.
I don't think the attack can work as described here. One of the features that GrapheneOS lists is:
> Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)
From my understanding, this means that even if you do have the signing keys, you cannot install an update that would remove the need for knowing the screen lock to unlock the filesystem's encryption - as installing such an update requires entering the screen lock first.
This is the issue with being lenient on crime but also being liberal. You have to search for the "right" patterns to find your criminal. It happens that folks who care about privacy, and criminals, two distinct groups search and use the same set of technologies: wether it's grapheneOS, or others. I am also tired of people still looking suspicious at me for not having instagram, snap or tiktok or use whatsapp, it's like I dropped out of society, and that I use linux and use open source email clients/server, I use ublock origin advanced with blocking of scripts and 3rd party domains. Why privacy is an uphill daily battle.
> I am also tired of people still looking suspicious at me for not having instagram, snap or tiktok or use whatsapp, it's like I dropped out of society,
social media was designed to appear like it is society, endorsed by the same people who _made_ the society
i think its all just an illusion to make us work harder :(
> Police were looking for […] Google Pixel phones. These have become popular among criminals in recent years […]. Among others, the murderers of Dutch crime reporter Peter R. de Vries had Google Pixel devices with them during the attack.
This is so braindead, it’s the same as “a black person committed a crime, lets search all black people!”
If someone with an iPhone commits a crime, will they do the same?
You can't decide to stop being black, but you can choose to not buy an iPhone. That's why race is a protected category and your smartphone is not.
And it is not "braindead". EncroChat was a "privacy service", selling phones featuring E2E encryption, disabled cameras and microphones, etc... Even though it wasn't marketed as such, it was mostly a service for criminals. And they effectively searched everyone using these devices (they hacked the firmware), and maybe a few people who weren't criminals got searched, as it happens in many investigations, most people turned out to be. The result was many arrests of people you really want to get arrested, with weapons, murder, torture, etc... being involved.
That's also the reason why mainstream apps like Signal are important for privacy, if only criminals use an app, having that app is a legitimate reason for being suspected. If most people using the app don't really need privacy and it is mostly used to talk about what to eat for dinner, that protects those who really need that privacy. And yes, it includes criminals, unfortunately, so it is actually a good thing for society when criminals use their own communication channels instead of using mainstream ones, good thing most of them are not so smart.
Peter R De Vries was a prolific crime reporter / journalist who did exceptional work in the Netherlands for many years until he was murdered in cold blood.
What it boils down to is that governments tend to prefer that the tools people have available to them are limited in capability.
iPhones and Apple systems in general are the most locked-down phones on the mainstream market, so very government-friendly in that sense.
It's why I'm always slightly disappointed to see developers using Apple systems. They're a far cry from the systems that Steve Wozniak originally built.
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
I thought that one of the goals of Wero was to become less dependent on US technology (Paypal). By requiring you to use either Android or iOS it seems to me as if that is more of a marketing ploy than anything else. As multiple other banks that support Wero however run on non-Google Android I think it is more likely that whoever wrote that message just doesn't know what they are talking about.
There will be no independence of US tech as long as everyone in europe has google or apple in their pocket and most administrations have windows on their PC. But, at least in germany, ruling parties are very slow to notice this.
They destroyed themselves by missing the window for starting an entirely new smartphone ecosystem. They should've either released Lumia years earlier before the iPhone/Android duopoly got established, or made their OS capable of running Android apps (e.g. by being Android).
My mortgage was with a bank that had a website but no app and I was happy, and then they merged with another bank and only had an app and no website and I was not at all happy (but the bank they merged with also had their own mortgage product with both app and website and I do not know why they didn't migrate to using that platform). I swiftly moved to a bank that incidentally had a lower interest and both a competent app and website, and I noted to the previous merged bank that the reason I was leaving is that they did not accommodate me. Whether that feedback was heard, I'm unsure.
Not an option if all banks follow suit. If this trend continues you would only switch to a bank who hasn't yet locked down their app yet.
Hopping banks is easy for just savings, but a lot of work and inconvenience for your standard payment accounts, and that's ignoring additional services like mortgages and insurance.
Indeed. It also fights symptoms rather than the underlying issue - that Google Play Integrity is an anti-competitive method that Google uses to shut out competition. The fact that Google-certified phones that are months behind on critical security updates (or even have malware in there updates as a recent case) do get a pass, shows that it is not really about security, but about destroying competition in the smartphone ecosystem as early as possible.
The solution is not voting with your wallet, but either leveraging the DMA or drafting new laws that counter this.
Either Google should be forced to approve secure alternatives like GrapheneOS or companies should be required to also implement AOSP attestation. Or alternatively, remote attestation should be banned completely, but I can understand the argument that it serves some legitimate uses.
I filed a complaint at ACM (Dutch authority consumer market) about this a while ago since you need to be a google partner to be approved and that is anti competitive. They were very interested in this and even asked for a follow-up. I think they have an open issue about this. So it is a good idea to contact your national authority.
I love how people think "vote with your wallet" is an option on most "vote with your wallet" issues. If people could vote with their wallets they wouldn't have to, would they?
Vote with your vote for politicians for common sense regulations that favor the consumer at the expense of everything else.
This is how it should work, but not how it does. Dutch banks don't pass down increases in interest rates simply because the risk of losing customers is so low [1]. Dutch consumers don't want, can't be bothered, or have such loyalty to their bank of choice, that even a criminally-low rate won't convince them to switch bank
Savings rates on all savings accounts are useless. Rabobank even has a managed passive investment account that functionally works like a savings account if you really don't want to use funds yourself [0], I think ING does too. If you do use funds or invest otherwise it doesn't matter which bank you use.
Dutch consumers don't want, can't be bothered, or have such loyalty to their bank of choice, that even a criminally-low rate won't convince them to switch bank
It is also just very hard in practice. A lot of people have their mortgages, savings that are locked for years, etc. at a bank. Also, switching a bank also impacts other family members if you have shared accounts, etc.
In this particular case it's also not fully clear yet whether Wero is starting to enforce this. If that happens to be the case, it's only a matter of time before other banks also start requiring Play Integrity for Wero transactions.
It's not hard to just move your savings. A lot of people do that actually; just keep the standard banking account for daily payments and all other services, and put savings in bank-managed ETFs, time deposits, or savings accounts with other banks (I do all three).
It's not hard to move your savings but due to some "coincidence" all Dutch banks keep their interest rates within a very narrow band (some advertise with higher interest rates you get for 6 months).
Dutch people are very averse to banks outside of the country due to the icesave affair and not trusting that for example Estonia or Italy will actually be able to make them whole in case of a crisis. So in the end are you moving your money from Rabobank to Andolubank (whoever they are) for 0.3% more interest? Probably not.
Reminds me of the tweet i saw:
"My bank, who passed all 14 interest rate increases on to my mortgage, and none of them on to my savings account interest, is currently sending me tips on how to spot financial scammers"
If Wero becomes the pan-european solution for online payments it is slated to become, then no European bank will be exempt from this. Given that as a European your government covers up to €100,000 placed at any European bank in case that bank goes tits-up, you are likely to end with a European bank in any case.
> If Wero becomes the pan-european solution for online payments
It most likely won't, because people want the security that cards offer when they order online. Wero could be good or even great for other things, but not for making online purchases from another country.
The Dutch do nothing but use Ideal, Wero's predecessor, for online purchases. People very much want to simply transfer money from their bank to a shop, just as they can with a debit card. Most Wero transfers will be to shops in your own country, but don't underestimate its potential. Valve offers Ideal on Steam, and has done so for years now, and they can probably give some very appealing insights into how that unlocked a massive amount of gamers in the Netherlands.
Nobody is worried that Valve isn't going to deliver what you purchase on Steam. Likewise few people are worried that they're going to be scammed by a well recognized national brand. That's why I specifically mentioned cross-country online shopping, where methods like Wero which offer no benefit at all to customers will have difficulties finding success. Unless there's a massive media campaign to tell people what they should do.
Shopping online beyond the national borders is a fraction of all shopping done online, and when it is done, people gravitate to big platforms like Amazon or Steam.
What Wero will do, is allow a German citizen to order stuff in a German shop, and an Italian citizen to order stuff in an Italian shop first and foremost. After that, it will allow them to pay for stuff on Vinted (people already buy second hand clothes across borders this way!) or Steam.
It will also make buying stuff in different European countries easier, but that is only a tiny percentage. The winners here are citizens being able to shop around further, and shops with dedicated national versions of their store to sell stuff easily to citizens in whichever country they decide to port their shop to (in addition to simply serving those who are fine with their shop in English or another language).
If you only know credit cards, you won't see the benefit, but Europe is predominantly a place of debit cards and local payment methods.
Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
That's their "Phase 1". They are currently building new infra. My ASN bank app just yesterday actually wanted me to go through some reauthentication flow for migrating to Wero so maybe they are actually moving to that now.
Always install these apps and negatively review them, specifically mention banning of GrapheneOS, there is absolutely no plausible reason for that.
I get banning rooted devices and unlocked bootloader (despite I disagree of them being ground for banning), but GrapheneOS left no possible excuse to anyone.
Because if you're not pre-compromised by somebody who will prevent you from behaving badly, they can't be sure you're not behaving badly.
And by behaving badly I mean using a client other than the one they expect to talk with their server.
Imagine if there was just one banking app, and whichever bank it talked to was just a setting, sort of like how pidgin and trillian worked with chat back in the day. That would make the banks feel small. You can't have control over your device because it might hurt their feelings.
I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
Just a heads-up from a fellow Pixel 6 owner: it has reached end-of-life last month, because the five years since the launch in October 2021 are up. Better start looking for a replacement soon.
My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits.
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.
This will keep happening so long as GrapheneOS is a "niche" operating system. We need to build up economic leverage by increasing GrapheneOS usage numbers until they can no longer afford to block it.
An OS available either for one Google product line or for a phone costing over 1000€ from Motorola, will never reach usage numbers high enough to change corporate policy on business grounds. (It may happen some executive within the company is just sympathetic to libre software even where there are no business pressures, but that's a long shot.)
Anyone who has been around in the free-phone community in the last decade-plus would recognize such idealism as mistaken and never once borne out in practice.
They are releasing a phone with official GrapheneOS support, but the operating system has to be reflashed by the user, and this phone will cost around $1,700.
Yes, but that's still a massive improvement. The phone will be much better than Pixels, and unlike Google, Motorola is actually capable of selling the phones worldwide.
It will be compatible but it won't come stock as they would breach their Google license (which is why you never see or never saw a pre-rooted phone sold by any official brand)
Many people here are missing what the business model of banks is, they're in the business of creating absolute trust with their customers, as soon as that evaporates, the banks stops being viable. That means eliminating any (perceived) risk, whether real or not. From the banks perspective this move reduces the attach surface thereby reducing risk which is worth the tradeoff of an inconvenience to the 1% of people that would even care about this move.
How is GrapheneOS a bigger risk than a stock Android missing 3y of security updates?
Given that all these banks happily accept the latter, we can conclude that they do not actually perceive any of this as a real risk. Ergo, something else is going on (eg incompetence)
Also, an owner of a grapheneOS phone is not going to perceive it as greater risk, and an owner of a non-grapheneOS phone is not going to give a shit either way whether they support an additional OS.
I remember my bank requiring to install a com plugin to use it, limiting it to windows. Later they moved to java applet limiting it to Linux 32-bit for some reason. Mostly it would not work on my hardware
This is a result of the duopoly. You abdicate too much responsibility to the platform because it is easier for you. It ends up in a spiral of more lock-in to the platform and more power to its owners.
GrapheneOS merely needs more users, so that there is more pressure on banks and other app devs to support these (or, to pressure Google in return for a more agnostic integrity check).
I therefore welcome the Motorola initiative to support GrapheneOS, but it would be even better if devices were sold with it, and even better if there were devices for multiple price points.
Does GrapheneOS even want more users? grapheneos.org does not look like a website that's trying to build up a large userbase or like it's trying to appeal to the general population.
The first thing the majority of people care about is what the OS will look like on their phone if they install it. There's not a single image of what will appear on my phones screen once I'm running GrapheneOS - that's a huge turnoff for the vast majority of people.
Compare that to apple.com/os/ios where the first thing your eyes rest on is a picture of a phone showing you what the OS looks like. Same deal for the features tab on android.com - they're showing you the features, not just giving you technical documentation for them.
If they do actually want to grow the userbase, there is a lot that needs to change - more than just getting bespoke deals to be supported on $1500+ small marketshare phones.
Recent suggestions of having screenshots for the new messenger app might give the answer. The official replies were "our users try out the new version directly instead of looking at static images of it" and that "a video would be needed" (links below)
Regardless, the developers are very experienced and smart, and know that screenshots are often used to advertise a product, so I guess it's a very conscious choice.
Also, Wero is going to be used for tap-to-pay in stores (initial roll-out planned for 2027). Carrying a second phone is going to be old pretty soon. Also, I think we should fight this on principle.
Ah so that is what is been happening. I suddenly lost the ability to pay my friends back last week. They did not tell me anything was about to change. I've been in contact with the service desk for about 4 days now, they themselves have not yet figured out that my e/os s9 is the problem it seems.
It should become illegal for these kinds of institutions to block access to random devices without reason.
How does the EU want to be self sufficient if even accessing your bank relies on an American advertising company?
Everything is being digitized, yet nothing has ever been as unusable as it is now
I was done with Android when I couldn't take screenshots of my Revolut/bank app/other apps. So far, iOS hasn't had a problem with this. Is it less secure, then? No, it was never about security, just control.
I don't know where you live but a lot of banks do not have physical offices anymore and when they do it is to talk about a large loan, not to do daily operations anymore.
The EU's push for digital sovereignty will win out over stuff like this in the end. They're going to want a European vetted version of Android. At least if I were European, that's what I'd want.
Dont take the fact that Wero still works for Bunq as an indicator that ASN or any other bank are doing something especially untowards.
Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.
I can't take bunq seriously because every time I approve a direct debit I keep seeing two transactions in the log -- one already processed and another still pending and also asking me to enter the pin again after it was approved.
Two of my credit unions (the only ones I tried) 'stealth block' this by refusing to accept checks I try to take pictures of. It will just refuse to work with a no descriptive error message. These are large credit unions.
One one hand with all the fraud and identity scams I know they have a difficult job. But, on the other, they also rely on sending me txts to login-no proper 2fa like TOTP security codes.
ASN was pretty bad - they recently wanted me to renew KYC/ID info. They wanted to install a Chrome Plugin that then would read the government KYC data. I nope'd out of that very fast. The alternative indeed was an app.
We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.
I'm not in the android rooting / modding scene anymore, but isn't there just a way to install a (Magisk?) module or something to spoof the Safetynet check anymore? I'm not saying that is a great idea, just in my memory theres workaround for this kinda thing.
There are two different Safetynet check levels. One (BasicIntegrity) is easily spoofable, bug GrapheneOS already passes that. The other requires Google certification.
So we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
Wero is an initiative introduced by the banks, not by the EU government. They specifically lobbied to make the "digital euro" initiative much worse so that it doesn't compete with Wero. So it makes sense that Wero has the interests of the banks in mind.
iDEAL | Wero was just a rebrand of iDEAL to make people get used to the new name Wero. The actual Wero roll-out has only just started. ASN and Bunq seem to be the first Dutch banks to actually roll out Wero (and not just renaming iDEAL to iDEAL | Wero).
ABN Amro also seems to be rolling out changes. I can't tell if it is just front end, but they did break some stuff. Including, annoyingly, making online payments without a phone.
The situation changes every couple of months, can't figure out if they unbroke it already.
Exactly. We are currently in a transition phase (of about a year iirc) where, for example, the fee will stay fixed. After that it will be a percentage of the total amount. Which is why Mollie announced[1] they would be launching a Wero alternative.
In the end this whole "buyer protection with percentage fee" is about the banks thinking: "We don't want to be a dumb digital sock for people's money. We have to provide value to them". But I want my bank to be a dumb digital sock to put my money in, nothing more. I'm really getting fat-up with all these MBA-types's thinking their company "needs to have a relation with me and add value". I mean I get emails from my utilities trying to get to know me. Seriously? I don't give a wooden nickle about my drinking water supplier. I just want to pay them and use their services and other than that I want to think about them as little as possible.
From the write-up, it looks like mollie will be using PSD2 Payment Initiation Service (PIS). Which is exactly what PSD2 PIS was meant for. Kudos to them.
The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can't be mitmed when the system trust store is manipulated
The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.
I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem
> To maintain that level of quality, we also need to be clear about our system requirements and avoid dedicating resources to troubleshooting issues on unsupported platforms and configurations.
This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue.
One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on.
But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.
It used to be common in Germany to order things (e.g. per mail order catalog) by giving your name, address and account number. I think it is still used when signing up for services. And "SEPA direct debit mandates" are still popular.
ASN has been dysfunctional for years. They needed a bailout and ever since have only deteriorated in their operations. To be fair, their risk management has surely improved and their new CEO is great. But their actual operations are superbad. They only do the easy loans and mortgages because anything else they can't do. Still I think as a bank they are doing well, everyone is opening accounts there. Marketing matters more than service I suppose.
It's a bit outdated. The big green one isn't in the government majority ownership for a year and some now, so we installed back those glass shelves and cocaine dispensers in all restrooms by now.
Yes, the state is divesting from ABN AMRO (and apparently making a profit on it) but ASN is still 100% owned. I think Rabobank was the only one of the big banks that did not need state sponsorship. Probably due to the fact they are a cooperation and don't have shareholders to please.
If you change phone operator, there is number portability. But changing banks is a lot harder.
The EU could do what the UK did, which is making switching bank bank account automated for people (transaction forwarding, migrating direct debit authorizations, etc.). A lot of people might switch to more competent banks. I'm stuck with Deutsche Bank in Germany, for example. Switching would be a bit of a hassle. I'd have to make sure all the direct debit stuff gets changed to the new account (tax office, various insurances, etc.) all doable but it's a bit of friction. I'd be chasing different companies with forms, emails, etc. for a while.
There are a lot of user hostile banks that deserve to lose their customers because of their ineptness. The surviving ones would probably become a lot more service friendly. That's what competition does. German banks are particularly bad. I've lived in other EU countries. So, I have hands on experience with more competent banks.
While no longer popular, decentralized banking via cryptocurrency/digital currency would have made unilateral access issues impossible.
Want to access your wallet on the chain? The tech doesn’t give a shit about what device you use. Just present the private key to wallet and access funds.
But alas the tech never took off beyond grifters/scammers and speculators use case. Also, people would rather trade the promise of safety that centralized banking promises (deposit insurance, regulations, access to person that may help resolve lock out issues, …).
The title sets a lot of blame on the bank, but there might be other factors at play. It is possible that either national or european regulations or laws makes it mandatory for the banks to comply with a set of security features that makes it impossible for them to offer services to degoogled phones. There might not be any alternative because it would cost too much money to develop and more importantly to distribute it. It can also be the case that Google uses its influence over the android open source project to make sure it will never be the case.
If Wero (assuming it's Wero) can push banks to implement Play Integrity, they can also make some guidelines or make a small SDK to for AOSP remote attestation. It's not terribly hard to implement and some banks already do.
I don't think there is an actual written regulation that talks about attestation or SafetyNet.
I can imagine in some meeting with the ministry or an industry association that somebody in charge said "implement all safety measures that Google and Apple provide, no excuses" and they just execute it.
I could also imagine there is a real need to do so. Maybe somebody found that criminals use rooted phones to robotically launder money or something like that. Or there was a criminal case where someone got a bank account with a fake ID and used it on a burner phone. Then the developers get a discrete notice from law enforcement or regulatory bodies and are told to close that gap. Who knows?
No. It may have been part of the founding of the bank back in the day, but I worked an intensive five years at Triodos and this is the first time I've even heard that word. No one I worked with or saw in the organization was related to that movement. It was clear to everyone there that as a bank we focus on providing a service that is socially positive for the community, and the people there did take that very seriously, but from what I've seen Dutch society has that to some extent embedded in its fabric.
I believe you that regular employees are not a part of this, and if it were just something the CEO believed I wouldn't care. But they use customer funds to fund ahtropospohical institutions. See, for example,
Those aren't some old examples that I had to dig deep into the bank's archives to find, theyre just two examples of grants that are highlighted on their website right now. You and your colleagues probably weren't related to anthroposophy, but the management and the funding decisions definitely are.
So stop using the application on your smartphone. Just use your desktop computer, and if they block that start going into the bank and make them pay real people at their real physical locations to do the work. Or use your phone to call them and do it over voice. Don't just give in and let them monetize you and force you to put insecure software on your hardware (like google play and other corporate controlled backdoors).
They don't block Graphene directly, they block any phone that doesn't have attestation, which the Graphene phone cannot have. https://grapheneos.org/usage#banking-apps
Basically, GrapheneOS on a phone counts as a "tampered" device.
Probably in-person at a branch. However they are allowed to use technology for certain tasks; their elders just have to discuss (and vote?) on it first.
Also the Amish are American and the American banking system is a very different (uglier) beast when we are talking about digitization when compared to the Dutch.
So much for european countries wanting to become independent
of the USA.
There is no cohesive strategy. It will literally require a new
generation of younger people to replace the old lobbyists here -
and some of these younger people will become corrupt lobbyists
as well.
Open standards should become a human right. I am not kidding. I
fail to see why services in a given country, get tied down to
foreign companies and foreign countries.
Nah. Unified Attestation is an initiative by some some companies that really have terrible security (years old kernels, drivers, firmware, often way behind on Android updates). They are also known for campaigns against GrapheneOS, including astroturfing. They also do a fair amount of eurowashing (in particular Volla, who sell UAE/Chinese phones as a European phone with a markup of hundreds of Euros).
If Unified Attestation would become a standard, they would use it to entrench themselves over GrapheneOS et al.
AOSP has an API for remote attestation attestation. Banks should just come up with a list of signing keys to be trusted. Heck, they can start here:
Incidentally I was happy to see that while they're phasing out their previous cryptographic identification device (that you put your bank card in) they will still support some kind of cryptographic usb dongle (in addition to smartphones).
When I wanted to open a second account a few months back, ABN is the only bank I have not tried because, well, I have my first account with them... I could not find similar option with any other, though.
I confirm that ABN AMRO's "Unable to open an account using the app" in the Netherlands is a procedure where a guy comes to your house to check your ID. I found it a really cool thing in terms of accessibility.
Your account appears to be shadowbanned (your current comment is visible because people vouched for it). I'm letting you know since looking at your recent comments I can't see any obvious reason. You might want to use the contact link to talk to hn about it.
Not quite true. All banks really want you to use their app, and the neobanks actually demand it (and get away with it because they are not as important as the so-called system banks).
But look at the pages more carefully, and you'll note that there is a way to open an account using just a web browser too (e.g., look at abnamro.nl). The links are deemphasised by using dark UI patterns of course.
ING is being really dirty about this. It should be possible to open an account, and get the OTP hardware device that reads the chip on the debit card, but they don't document how you can open an account without the app. It's probably possible, as existing customers can bank without the app, but you will probably have to call them.
Banks would love to get rid of all those nasty people without approved smartphones, but that would cause political pushback.
Thats simply not true. If I want to open an account I can go to a Rabobank office and open an account. There are still plenty of Rabobank offices around. I can also access all features (even pay with Wero / iDeal) via my Rabobank scanner on my desktop via their website.
Well guess why they do that, they're not taking your freedrums, Americans, this is a legitimate anti fraud framework step, dont ask, I work in payment processing.
SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
> if a major regulator like EU steps in
Even if they did, I feel the result will be the opposite of what you expect. EU own reference implementation of eID relies upon Play Integrity [0].
[0]: https://github.com/eu-digital-identity-wallet/eudi-app-andro...
We should force some executives to enable their kids to play rublox on a non play integrity device.
That would solve the issue rather quickly.
Don't think this would work as well as you think it would. One of the privileges of being an executive is that you basically have unlimited access to money so their kids are playing roblox on ipads (each kid has their own).
It reminds me of this time I learned for the first time about heated driveways so I was talking to my coworker and friend about how if I was a multimillionaire, I would have one of those things and I would never have to shovel snow again. He replied by saying I don't understand how being a multimillionaire works.
I don't get it. Is it because rich people don't need heated driveways because they hire people to shovel snow? Evidently I don't understand either :D
A simple millionaire hires people to shovel snow. A multi-millionaire doesn't even think about such trivialities as snow, because their assistant has a budget and proactively makes sure the property is always taken care of. (Or more likely, they live somewhere where it never snows anyway.)
Oh, the horror! The digital pacifier does not work on this weird cheap phone
Normies don't understand the that any computer should be able to run software from any other computer. They dont get the idea of the general purpose computer. They've bought into the idea of computers-as-appliances sold by steve jobs and others.
The executives you're talking about don't see an issue with this. Their solution for this is the same as everything else: spend more money and buy another device. User freedom does not even enter the equation.
Yes, and it's even worse than that. Phone, tablet, TV box manufacturers now routinely lock the bootloader of the devices they make. This means that even if you are willing to sacrifice device attestion for the sake of freedom, you can't replace the firmware/OS, unless some exploit or other workaround is found. These corporations treat the device as a storefront from which to extract additional revenue and spy on their customers for their benefit. It's truly shocking, and Apple convinced normies that it's normal.
What gives you the right to determine how others should use their computing devices? Or should want to use their devices?
I need to warn you that your questions are not addressing any parts of the post you're replying to.
It does sort of..
If they identify as a normie or an appliance peddler who is offended by the tone suggesting computers "should" be general purpose?
Or they are offended by the implication that said normies are perhaps unable to understand this lost potential, rather than making principled choices to embrace the appliance shlock?
They are doing the same with Wero.
I believe the fit is so poor that google should really object to it. I already refuse to make youtube videos because I need my gmail account.[1] If I need my google account for my ID and my payments I cant use gmail.[2] I also don't need Google ads badly enough.
It doesn't take a lot of stupid to lose the account but ANY account activity at all may trigger false positives.
In theory the US government can seize EU google accounts. Given time I'm sure we can find even crazier rulers than Ursula and Donald combined.
[1] - I got one flag for a 10 min video including 10 sec of 1991 footage from a local NZ news agency credited both in the video and linked in the description.
[2] - I've already lost my account once temporarily for jokingly hitting reply-all without looking how many cc's there were.
> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.
There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.
Because these API are not meant to be public for the end user to use.
Access to that kind of data requires regulation, a lot of it and that's why Third Party Providers exist. There are a lot of them in Europe and they're not expensive.
I actually didn't expect to find anything about bunq around here but I have to say they're the worst bank I've worked with. When we started working with them, their API were broken and the devs had no idea why. It seems to have improved recently but it's definitely not a bank to praise for their API.
Bunq… It’s great that they have an API, but to use it, I had to clone their SDK, and manually fix everything that was broken, add some workarounds, and now it works. Documentation was all from the announcement in 2016, me using it was ~2022, and some undocumented things changed since. Still, better than no API, which is what everyone else seems to offer.
And now we have a paypal-like shopping experience via SEPA Instant Payments, all our PayPal hating customers are happy ;)
> Because these API are not meant to be public for the end user to use.
I know, that's my point. It's a stupid decision.
> Access to that kind of data requires regulation
It's my data. I want to access it how I see fit.
> There are a lot of them in Europe and they're not expensive.
I already have a bank and I already pay them. I don't want to pay anyone else to be able to use my bank account in a way that suits me. Sadly, there aren't many good options.
Someone mentioned Wise, and they do seem pretty interesting. But it makes no sense why common high strees banks refuse to cater to power users, or even to users who aren't using mainstream devices.
>It's my data. I want to access it how I see fit
It ain't your data, it's the bank's data about you. Banks are shitty about access, APIs because they are perpetually in CYA mode from KYC/AML rules from the US (also on most foreign banks) and GDPR and cousins in Europe.
I was actually surprised how many bank apps will work under GrapheneOS even if only partially.
> But it makes no sense why common high strees banks refuse to cater to power users
"Power users" don't make them more money. In fact, from their POV, you're a legal, reputational, and security liability.
Reputational and security liability is highly debatable. Legal is highly jurisdiction dependant.
They often act as marketing and can find and report security vulnerabilities rather than the criminal element doing so first.
> Reputational and security liability is highly debatable
Hmmm then why are banks telling people to not use AI systems to log into their bank?
https://www.reuters.com/legal/government/us-banks-detect-una...
https://www.cbc.ca/news/business/canadian-banks-block-ai-9.7...
Whilst not PSD2/PSD3, I've been super happy with Wise; an excellent API, good quality docs. A _proper_ test environment that you can drive using hooks they expose. Nothing but praise for them, including their support, which has helped me around the clock even on weird questions such as why my custom integration fails to send a transaction (mismatched currency between recipient and transfer in my code).
Not going to be a good day when Wise or Plaid are breached and accounts start being drained. Adding middlemen is not a solution to poor banking services.
Wise is not a bank, is not licensed as a bank, and is thus not insured like a bank is.
Balances are held in Wise at your own risk.
In Hungary you don't get documentation for these APIs only in pdfs via email, and if you get it the APIs are not stable, constantly breaking. I was always dreaming about creating an automated testing suite and report all of the issues automatically to the national bank, which is the supervisor of all commercial banks in HU, in a hope to punish them.
You guys get APIs??
Seriously, count your blessings man. In America we only get Plaid, which only works right or reliably for big banks (which are also the worst ones), and it isn’t an API for humans, just a paid SaaS product that a company who wants to offer integration with banks has to pay (i assume a lot) for.
> "Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful
You mean the step from sandbox to production application, or you're not even getting access to the sandbox itself? I managed to get sandbox access with ease via two separate banks (both Spanish though), with no problems, think it took them one (working) day or something to review my "application". I never tried to get anything into the production environments though, but makes sense they'd be a bit tighter on that tbh.
Not sure why you'd claim it's impossible, it's in wide use already by banks, fintech and payment service providers across the union.
I should have added that it's impossible for individuals, not for fintech providers.
I guess I should have clarified too, I'm an individual, not a fintech provider.
Why would banks be motivated to care? People just give them money as a business model. Up until recently, Wells Fargo didnt have case sensitive passwords even, because no pressure to do anything about that.
To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.
They are breaking the law, that should be motivation enough. That the number of non android non ios users is small shouldn't be relevant. The locked down android and apple devices are like virtual US soil. The obligation should be to service all EU citizens rather than a sub set.
>> People just give them money as a business model.
You dont actually give them money...you loan them money when you do a deposit. That is why they pay you interest, and that comes with the risk of loans to another party.
A little detail they are happy to omit and they are happy to let people talk about: "I have money in the bank", that you of course ...dont have.
At least in the US most banks are FDIC insured so your first $250k or so in deposits are secured by the government.
There's no real risk involved.
Incorrect-ish. 12 U.S.C. § 1821(f)(1) states that payment shall be made by the FDIC "as soon as possible," but as my sister-the-lawyer has always been at pains to point out to me, the most up-to-date specific language is from 2016's 81 Federal Register 87734, 87735, section B, which explicitly states that they "[do] not specify a time period for paying insured depositors." In other words, if it's a tiny bank failure you might get lucky and get made whole in a few business days, but if it's something larger, they can choose to meet their regulatory obligations over the course of decades - which is very much real risk.
I mean, I get it, but that would destroy any credibility of the insurance, and would undermine the whole point of the system.
I trust the FDIC to be far more johnny on the spot to resolve a liquidity issue than I do any private entity
The existence of the FDIC is in itself, the proof there is risk involved :-)
As of June 2026, the FDIC had approximately $161 billion in its insurance fund against...drum roll... $10.8 trillion in insured deposits.
Good luck calling on your insurance on a systemic bank crisis....
Even when the current funds available are insufficient, it can borrow from the federal government or issue debt to cover the insured deposits.
A situation which calls that borrowing capability into question would mean the economy is so bad the dollar is worthless.
This particular insurer is unlike others because it can ultimately edit entries in a database whenever it wants. As long as you are part of the group that is considered worth editing the database for, such as a depositor at one of the too-big-to-fail banks, then you have nothing to worry about.
> At least in the US most banks are FDIC insured so your first $250k
More if you're in Silicon Valley… semi-/s
Ehhhh, I'll take a law over begging and praying.
The interest rate banks pay you has been 0% since before covid
That's definitely not universally true; my US bank pays 3.2% interest on savings
And what is inflation?
A general, continuous increase in the overall price level of goods and services in an economy over time.
Not really related to the discussion here though, since we were determining whether the interest rate is zero.
This is a thread about a EU bank, and banks in the EU both have some standard interest rate on savings accounts, and moreover might offer time-restricted savings accounts with an even higher rate. That said, they track poorly with inflation compared to actual investment.
I get 4% (instant access savings account with Revolut, UK)
Ally has been 2% from before Covid and currently is at 3.2%
Zero is also a number, although not all Mathematicians accept that. 0% interest does not change the essence of the monetary relationship with your bank, or the risk profile.
My bank in the uk pays me 3%
I have been able to easily find a US bank that pays roughly SOFR minus 25 basis points for FDIC insured savings accounts, even before 2020.
isnt it the opposite in parts of the EU? you pay interest on the deposit
I don’t know of any bank that hides the fact they lend out money. Most pretty actively advertise it.
Technically true I suppose. But go ask the average person on the street where the bank gets the money they lend people for mortgages and cars and such and I guarantee you the number of people that make that connection is going to be much much smaller than you seem to want to suggest.
It doesn't actually work the way it's portrayed in It's a Wonderful Life. The banks don't use depositor money to make loans. I suspect you will think what they actually do is even worse. Look into fractional reserve banking.
Never seen that movie but did watch a documentary ages ago about fractional reserve banking yes.
The bank still uses the deposit money in that system. You are right to point out those same people on the street I mentioned would freak out even more if they knew that banks essentially lend out more than we deposited and also that they might sell your debt and all that jazz (I bet most people either never understood what happened in 2008 or forgot already other than a vague "yeah mortgage crisis")
>> I don’t know of any bank that hides the fact they lend out money.
Absolutely true. They question here is how many announce they are borrowing from you :-)
This is like those articles that say, "[entity] quietly [doing totally normal thing]" to frame it like it's some devious thing.
That's what banks do. It's not a secret. Any cursory understanding of banking gives you that information.
> Why would banks be motivated to care?
Because courts have made them pay the curtomer their losses when the customer (not the bank) was scammed/hacked/etc.
And you don't think that plays some part in all these arcane security requirements that basically amount to "you're doing something a little weird so we're just going to block you rather than support it"?
> Why would banks be motivated to care?
Unfortunately, banks can be held liable for customers getting scammed. Even if they win in the end, they have to make the customer whole first no matter what [1].
[1] https://www.tagesschau.de/wirtschaft/verbraucher/eugh-konto-...
Banks are motivated to care, but in the direction they currently do. They can be on the hook for making up losses. Whether you as an ultra leet hax0r can run rooted/jailbroken devices without getting owned, they are worried about your non-leet parents doing the same and having their retirement accounts drained by North Korea. I know it sounds far fetched, but it is a plausible scenario that I heard recently
The same banks that typically embrace the 3 biggest signs of security stupidity:
- max length of passwords (not talking about lengths that would pose a DoS threat, talking limits like 20 characters)
- incredibly constrained character set for passwords (“your password can’t contain a quotation mark, only alphanumeric and these specific 10 punctuation marks”)
- “security” questions (can we just ban these already? Knowing that my childhood dog’s name was Bingo should NOT give you the ability to change my brokerage password.)
> But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.
Same reason why media companies spend millions on DRM that delays the pirates by 0 days. Checklist-driven "security", CYA and out of touch executives calling the shots.
Did the higher ups want more effort to be spent on "security"? Yes. Is there any way to actually add "more security" to the setup? No. Could not doing anything in face of direct orders from the above be bad for your career? Yes. So random bullshit go.
It's not like the bank client developers are even implementing any of it themselves. They buy someone else's middleware and hopefully don't misconfigure it when they cram it into their builds.
Because the bank takes liability if money is taken from your account without your permission.
in order to minimize chances of someone stealing 6 billion out of them that's why
It wansn't a mistake, it was a deliberate attack on the user, i.e. malware.
I'm convinced the Amazon Fire Phone was the motivation for SafetyNet.
The Fire Phone was a midrange Android phone from 2014 preloaded with Amazon's app store and services instead of Google's. It failed on its own merits, but I think Google got scared someone else would do a better job. The barrier to entry is a lot higher if most people can't use their banking app on it.
More it was the banks were made liable for stolen funds. So they responded by making funds harder to steal.
Do you really think banks care about you installing custom themes or whatever? They only care because the cracked Spotify app also has malware bundled on the side which uses the new root access to break the app sandboxes.
It is both.
I also consider restrictions against open source to be malicious acts - hence also malware, such as by banks and other companies. Or, worse, government agencies. In a local medical university in central Europe, for instance, we are required to either have a Google account or a Microsoft account - usually the latter, to access emails.
All paid by the taxpayers ...
Yeah, you’re right man. The bank is just hell bent on stopping you from using GrapheneOS just because they’re in the pocket of Big Google or whatever. It’s gotta be malice. It’s not about liability at all.
Mostly the government forces them to do this. If the capability did not exist it wouldn't be mandated or used. Think about this whenever someone tells you "just don't use it if you don't like it", about everything.
There is something really tragic here.
EU has PSD2 which enforce good, strong rules on customer authentication. For example, banks must have two-factor authentication. And if both factors live on the same phone, the bank has to safeguard against that phone being compromised. Hence the root detection and app-integrity checks that he is complaining about.
But what's tragic is that instead of understanding the problem, which is partly driven by regulation and mostly not even a problem, he calls for more government regulation. What a mess.
The issue is weird. Banking is both conservative and on the lookout for new way to make things complicated, but one dumb executive --usually-- can't derail the entire bank, because there are enough stops in place. This is one of the reasons US banking is such a ridiculous mix of various integrations of a line of executive decisions resulting indirectly from lunches with said executives.
I don't know if there is a common API standard from a technical point of view, but there is the legal framework for it. Banks in the the EU have to provide an access to third parties who provide account information services to clients (themselves being regulated and supervised by a national agency). I would assume because it is mandatory, it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.
> it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.
it would be if wasn't for the obvious reasons of those being banks
If there wasn't SafetyNet it'd be something else, probably per OEM like Knox which would be worst.
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which always include all of the user hostile bullshit you mentioned.
It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/
The only way this can NOT happen is if someone quite senior signs off on the risk, who would have to get in a big fight with the cyber/policy teams for basically no benefit to themselves. They would also have to be unusually technical and pro freedom to even understand the issues, which is not the typical personality profile of the kind of executive who ends up with overall risk authority for a bank's mobile app.
I once was dragged into a meeting after a security audit where the audit flagged in red that we weren't encrypting a SQLite database.
I basically said it was bullshit, pointed out that this was not industry best practice, and that we weren't storing any sensitive information.
The meeting ended quickly (and it became clear that the auditors were full of hot air.)
yeah, there are a lot of bad auditors in all kinds of ways, mostly:
- auditors which commonly "pass" things which should be flagged, but happen to be a more expensive then normal industry standard in ways which should make them non-competive but somehow they get hired a lot
- auditors which flag nonsense and don't understand anything about security at all
some of the "security frameworks" which are applied by default makes a lot assumptions about how software is build/structured/works _based on what was common in the 90th_, and they don't even list their own assumptions... Luckily they are a base line you can perfectly fulfill but still a pain.
Like e.g. a session key having 128bit entropy is a reasonable minimum, but then imagine the framework assumes the session key & session id are the same because some 90th software did so and now requires you session ids to have 128bit entropy, but e.g. UUIDv4 has only 122bit entropy and a UUID being used is deeply integrated into middle-ware you use and can't be changed... (And having a session id=session key setup is anyway a bad idea as it means you mustn't log the session id anymore, but you also might have requirements which do require logging session ids in audit logs and similar).
This isn't even the most nonsensical thing I had ran into, just one I remember well. There where rules based on assumptions of you uploading files into a file system _using the upload file name_ while interleaving security sensitive web-server config files with uploaded directories ... like yes I know some software did so in the past but the rule should be "your software musn't do such a negligent thing" and not "you software must do this 5 extra steps in case it maybe does that insane negligent thing"
My previous bank app (HSBC) detected that I'd jailbroken my iPhone, and warned me, but allowed me to continue at my own risk, which I appreciated
Instead of asking the government to fit all banks' products to your preferences, you could just use a bank that fits your preferences.
I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).
> you could just use a bank that fits your preferences.
you assume this exists / can exist
(for a given set of reasonable requirements which aren't yours)
but various "practices" and "regulations" for software security push banks into the direction of such nonsense, so if a major reasons this is happening is the government asking them to fix it is very reasonable
similar in other context where that argument is often used you have problems like monopolies, collusive agreements or various source pushing companies into acting collectively user hostile weather it's laws or other reasons
the government fixing such things by changing laws/regulations is pretty much the only things which can work in many cases
this doesn't mean they have to tell companies exactly what to do, instead they (should) find out what pushes things in bad directions and then "counter balance it" in some form or way
You can do both
> banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it"
Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.
Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.
> forces banks to provide access through a common API standard
Doesn't PSD2 already provide this?
I think this is good actually. We have taken the convenience vs security trade off too much towards the former either because or due to how busy and intense life is nowadays. Waiting 4hr to make a big purchase should almost never be a problem.
No, the banking system just runs so perennially behind the times that they suffer from baroque issues that no one else has had in 20 years.
Eg the above example; how is it possible to send money without knowing who the other side is? I can trivially look up a domain name and see registration info, I can look up the IP to see who it’s registered to, I can check certs to see if they’re valid and legit.
It’s bizarre how normal we think it is to send large sums to random strings of digits that we think are Amazon or the IRS with basically 0 way to validate them.
I bought a house in cash and putting the money in escrow was unbelievably stressful. They send me numbers, on a printout that’s a scan of a scan of a scan with text that says “call to make sure this is still the right account number”, and a bajillion warnings to make sure the number is right or vague and terrible things might happen.
Insanity that I can get insanely complicated gadgets shipped to my house in 4 hours but we don’t have a better way to move 6 figure sums than “double check your numbers”.
In Finland at least there’s now recipient (name) verification, so it absolutely can be done. When you transfer money to someone, it will check your input against the true account holder and will warn if they don’t match. You can ignore the warning at your own peril.
That seems like a big regression versus a paper check. With a check I can “spend” the money immediately, or at least commit to spending it. It isn’t deducted until the check clears (which is a pain) but I don’t have to wait around for 4 hours apologizing to the seller until I’m allowed to transfer my own money.
This reads like you’ve never made a large purchase outside of the internet. I don’t know why you’d advocate for this except to be contrarian.
I recently had a family member with a medical emergency in a foreign country with only 1 direct flight to cross an ocean, and there was a narrow window of time to buy the very limited supply of lie flat seats needed to make the trip so medical care could be resumed as quickly as possible.
It was nice to be able to spend $30k+ on short notice. With modern security features, there is no need to enforce an arbitrary time limit if the payer accepts the risks.
What exactly do you mean by sending that $30k at your own risk? Like are you suggesting if you sent it to the wrong entity (say they turned out to be a scammer) and the bank shrugged, you'd be fine with it because you took the risk? If yes, do you think most people would? I feel like most people expect more safeguards and recourse when the transaction amount is higher, not less.
> By now
Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
The USA read that quote and said to itself, finally, an ideological system we can get behind!
> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
You mean like HTTPS? It's a shame that mobile banking website have fallen out of favor.
I'd really love to see your banking app that works differently and cannot super trivially be attacked by malicious software. Can you show us your example of such an app? It might be helpful to show tha validity of your arguments.
Sounds like Open banking
Which is not very open, it just means it's open to other companies. If I want my own data there is no api for me.
There is bunq, which offers a full API for regular users, including a web hook call in case of new transactions. Made me actually switch to them. Super nice so far.
https://doc.bunq.com/
Exactly, it's an utterly ludicrous state of affairs that I'd have to give access to a third party to my freaking bank details. And this is treated as some kind of success?
One of my agents has (read only) access to my accounts. I do it via Era, which is quite good, though expensive (they try to justify this with other functionality, but they provide nothing my agent can't do itself other than the API access).
To provide me with API access to my own accounts, Era goes through another third party provider which again connects to my bank. I guess they could eventually get direct connections themselves.
So instead of me get convenient read-only access to my bank, I've ended up giving two separate third party providers credentials I'd prefer they didn't have.
All I'd need was an automated way to get a CSV or JSON dump of my transactions and I'd have been happy, but none of my banks support that without manually logging in. It's infuriating.
Open banking isn’t mandatory. Psd2 and successors are. But it does not require the banks to expose feature parity APIs so others can replicate their apps.
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
But that is quite limited.
People need to stop calling for the EU "to step in", they already have and made everything worse. They forced PSD2 with """"""""""""""Open Banking""""""""""""""" which requires convoluted requirements and is regulated to death so no private person can call the API themselves and get e.g. their balance or transactions.
I like complaining about it too, but it's still a massive step forward from how things were before, where I had no access. Now I at least have access even if it involves going via third parties.
How is that worse? It's only "open" in the sense that other licensed businesses can provide services that integrate with your bank account, but it didn't take anything away.
The worst part is: you can't escape them.
You need to have a bank account to live a life outside the woods.
I have multiple bank accounts, because I am a solopreneur, yet all of them are weird in their own ways
I saw my bank embedding a keylogger and it was even scrapping the password entered to login and basically slurping everything done on the page to an external domain. I checked with the bank and they said these were their analytics and nothing to worry...
I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.
the alternative is letting binance give your money to north koreans.
It's a very difficult set of choices.
I'm not saying that crypto currencies are the solution to everything wrong with the banking system, but if you have crypto at Binance you do in fact not own any crypto at all and are literally using them as a bank, just an unregulated one. You get the worst of both worlds.
When you actually own your crypto currencies because you have the keys Binance cannot give away your money to North Koreans.
Much better - enforce that every bank that has app has a website and feature parity between both.
And that the website is fully usable by any W3C-compliant browswer.
And that common API would require safety net too. Banks and the government are the same thing: the enemy of of free computing.
SafetyNet indeed was and it was not a mistake. Mistakes are bugs, a company doing things they didn't want to do, or didn't intend to have the effect it later had.
Banks on the other hand, as much as hateable (most of them are), also just shit bricks at mere thought of one regulatory spanking, not only hammering from their boards and shareholders (esp. the major ones). So – it might be a great idea to not shit on banks shitting on such choices.
Banks are also sacred of making changes and going farther from the "mainstream" and another reason is also because - they handle "real money", often people's entire life-savings.
We just think:
… oh, this OS is soo cool, so safe, let's use this.
… And then notice: goodness, this motherfucking company is not letting me use their app on this coolest and safest shit out there. Burn them!
And banks think:
… shit this one is not part of any common industry standards, let's stay the fuck away from it.
… Further: ha, authorities don't look kindly on this OS, let's stay extra away from it.
… And more: will this mean we have to support one more standard, one more release channel, one more modified OS? Anyone who mentions name of this OS again will thrown out of the window of highest floor of our HQ (and mind it, we are on 33rd already).
Solution (one of the) is forcing Googles and Apples to stay open, to stay respectful of user privacy in an absolute and transparent manner, to not let them implement closed-off protocols, to have APIs that is not availalbe to everyone – in a safe manner, not let them (and the politicians and security agencies) fear-monger the public like "think of the children" etc. Blaming banks is literally barking up the wrong tree – esp. in this context.
Another way is: not buying these devices and suffer the pain (and experience the bliss, yes!) and then hope/work for this number to increase and collectively point a thick and long shimmering hot rod (metamorphically speaking) at the hinds of such companies (hell, include the banks as well – so that they won't fuck up their desktop and mobile portals) so that they collectively feel the heat and are forced to bend (no metaphors here!). But no, we won't let go of our annual pleasure of this practically bullshit <First Time on an X>™ orgasms.
tl;dr: SafetyNet was not a mistake, making something like SafetyNet into the monster it and then making it limited to one company/one publisher (esp. since they are the ones who also control the OS) was the mistake. I think of this to be solveable sometnhing on the lines of multiple certificate issuers (but we have to be careful of eMudhras) - both for safetynets, and app stores (if not combined).
Safetynet was not a mistake; it was a lock-in mechanism. Widespread failure to call it out as such and oppose it as happened when Microsoft proposed something similar for PCs a decade earlier[0] was the mistake.
> will this mean we have to support one more standard, one more release channel, one more modified OS?
Android apps don't have to take any active steps to support third-party distributions. All they have to do is refrain from taking active stops to block them, but I suspect you knew that.
[0] https://www.nytimes.com/2003/06/30/business/technology-a-saf...
> 120MB APKs full of obfuscated code
Wow, where'd you find a bank with a mobile app that lean? Please share for everybody's benefit! /s
Half a gigabyte of app bundles is unfortunately no longer an outlier...
Nah SafetyNet offloaded a huge chunk of security on Android from app makers to Google/AOSP, it's an excellent system that works great for 99.99% of uses. It's what allows safe and fast banking on Android in general.
I'm skeptical.
An immutable OS install and app sandboxing by default provide a lot of security. Those are present on third-party Android distributions that don't pass SafetyNet. Some users of those add root access so they can let a handful of apps out of the sandbox, but I'm willing to bet most of those are tech experts with better security habits than the average person.
Show me examples of actual data breaches and account takeovers SafetyNet would have stopped if you really want to defend this position.
It's an excellent system that forbids up-to-date open source systems, but is completely ok with systems that are several years behind in security patches.
It's just a way for app makers to point their finger at someone else.
It's a system that allows even those old systems to still use banking reliably and securely, so yeah I'd say it's an excellent system. As far as GrapheneOS goes - now that they're partnered with Motorola they might actually get some certification, along with a proper security audit from Google. Not sure what the details of the supported functionality are gonna be there.
> It's a system that allows even those old systems to still use banking reliably and securely
No, Play Integrity labels those old systems as secure, _even though they are not secure_ due to lacking years of security patches.
Play Integrity does not prove that something is _secure_, only that the OS that is running _was approved by the phone maker_.
Older Android phones that haven't received security updates for two years are not secure. The Play Integrity check therefore does not mean that the phone is secure, but only that it is a certified smartphone that came with Google services preinstalled.
> It's a system that allows even those old systems to still use banking reliably and securely
This is the crux of your entire argument, so you kind of need to actually substantiate it. Does Play Integrity catch an app from to Play Store using an exploit against a comically ancient vendor kernel to do anything it wants? How?
Ultimate seamless experience at the best value, best-in-class modern technology with intuitive mouth feel?
EU wants to have as much surveillance as possible, that's their only interest.
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Not any more.
Most European banks either don't have a web banking at all, or require a mobile app to log into it. There are exceptions but they are rare and becoming even rarer.
In Thailand pretty much all of the banks are shutting down their websites. App only, typically requiring visiting a branch to register the app on your phone, blocking screenshots, and often blocking vpn or 1.1.1.1 access. :-(
That's good time to switch.
> it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Not all banks. Monzo doesn't have banking through the website, and I doubt they're the only ones.
I just looked and apparently they do have a user API. It looks like it covers a lot of the functionality of the app.
https://docs.monzo.com/#introduction
That's true for personal accounts. Monzo business accounts can be managed through their website (with authentication via mobile device).
Well that's not really true. There's most definitely functionality that is only available in the app. If I want to make a payment without having to dig a card reader out every single time, I absolutely have to use my bank's app.
> "Well that's not really true. There's most definitely functionality that is only available in the app. If I want to make a payment without having to dig a card reader out every single time, I absolutely have to use my bank's app."
Maybe not for you, but you don't know his bank. Obviously I can't pay with my phone if I sit at my computer and use online banking in browser, so obviously payment with phone app won't work if I use browser on phone, for all other online banking functionality there is no benefit in the app, all of my 3 banks I regularly use don't require any card reader or even smartphone, all I need is any phone being able to receive SMS with 2FA codes, if my bank required app to use online banking I would just stop using their services. I am not going to bother with app in the phone while sitting at computer with 32" display and proper keyboard.
The parent commenter was implying anyone can just go to their banks website, I'm pointing out that in the case of my bank there is valuable functionality locked in the app and I'm sure it's not the only one.
My bank doesn't have a website I can log into.
Sounds like you know what to do, then.
There are no reasonable banks to switch to that have a website. The last good one got bought up in 2022. All the ones that are left have been a horrible experience to use.
But not with a VPN. Hackers might use a VPN.
I've used smile since 2004. It has an app which is fine, or I use the webpage which has more choice. I used HSBC before then which had a web interface, I vaguely remember natwest had special software for computer banking in the 90s, that might have been business accounts only, and potentially even was dialing direct to their systems rather than via the internet.
There are app only banks, you make your choice and you pay your price.
My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years...
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess? Not how I'd architect it...
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
[0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe...
[1] https://walt.is/
[2] https://www.curve.com/
> The Rabobank app works fine on Android phones that haven't seen updates in years...
Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.
They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated. Another thing is actually supportability. Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.
Now, that isn't to say there aren't security issues, nor that QA is perfect on devices they do support (like with any enterprise software projects), but it is a valid reason from a business perspective to not support everything.
Why do you think generally OpenBSD and such platforms aren't supported by commercial software, nor most open-source software? It adds a lot of burden for testing and QA on developers who will need to become intricately familiar with yet another platform.
People stare blindly at some customer support answers and hinge everything on those words, but if you think carefully about how software, compatibility and support work, this all makes perfect sense.
> They do not block unupdated phones because that will force users to buy exceptionally expensive devices to keep updated.
Hardly true, if they permitted Lineage and so on.
> Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.
Not really, there are a myriad of devices and they're not testing on all of them. A "pound sand if you're on an unsupported device and it isn't working" policy would be perfectly acceptable, as long as the issue isn't directly caused by the developer purposefully breaking the application for a subset of users that fail Play Protect check or whatever.
> Hardly true, if they permitted Lineage and so on.
GrapheneOS have written about (in)security of LineageOS:
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
I'm sure they're completely unbiased source. But seriously, the real question is whether lineage is more or less secure than the stock ROMs that are currently allowed.
"Hardly true, if they permitted Lineage and so on."
I agree, but that is also totally unrealistic for normal people.
Btw, My son has a 200 eur Samsung Galaxy A26, very fine device for the price I have to say, and supported until feb 2031.
This bank claims "security is very important to them". In another, the poster reports getting training spam every week.
Installing Lineage isn't that hard. If they're going to badly inconvenience some customers / force hardware purchases, why not start with the ones who are most likely to get their accounts drained?
If any of what you were saying were true, then this wouldn't be just a discussion about banking software all the time, and we would see it happen with all kinds of other software, scaling with the complexity of the application or the level of provided customer support or the intended sophistication of the user or how "enterprise" the target market sounds... but none of this is the case, and if you tried to cluster products that do this along some axes the ones that stick out like a sore thumb are all of the form "controls something sensitive": money (banking, payments, investing, etc.), health data, copyrighted media (streaming), and multiplayer gaming (due to cheating issues). All of these people are very open about why they think they do it, and while we know they are incompetent, they are not doing it to be malicious and they have no incentive to lie to you about this: if a bank were truly not supporting your device because it was rare, they'd just say it, and we have ample evidence of this from banks choosing to not support "niche" browsers (including an era of "anything other than IE6" omg ;P). So: "cool story bro", but it is clearly wrong, lol.
It's not about your security nor your account. They are protecting their app, their apis, their servers. Everything that makes the life more complicated for hackers will be deployed, even if that includes power-users hacking their own stuff.
Blocking people from rooting their own devices isn't meaningfully contributing to security, even if they think it is. Not relying on security through obscurity is one of the first things you learn when studying the subject.
Not relying on security through obscurity doesn't mean obscuring things is bad for security, it just means this is not sufficient. Relying only on this or getting a false sense of security due to this would be bad.
That would be on Google. If Google says the phone with zero updates for 5 years passes system integrity, then who we are to argue
For Google control is the issue (and the data flowing with it), not security, and once again we in Europe just swallow that shit and mess up our supposed "open" standards. In this case it really is because there are no competent people making these decisions. They just trust Google when they say: "It's for security".
I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the US and YOU are throwing YOUR privacy conscious users under the bus, because you do not fully understand the forces at play.
Idk, this can be much improved :)
> It's not, it's more about sovereignty and control
The bank doesn't care about either. It cares about the risks, costs and opinion of the regulator on how well it evaluates and controls those risks.
If risks can be transferred to an external party and DNB signs on it, sure. If DNB says reliance on this specific external party is a risk in itself, then sure, there will be a plan for that too. The plan could be "if google becomes a problem we can publish a new version of the app using grapheneos attestation anchors in N weeks"
Of course they pass system integrity. The whole point of the thing is not "it should be secure", it's "the user has not messed with it so we control it".
If the device is "insecure", doesn't that mean you - as a user - can exploit one of those insecurities to "mess with" the device without system integrity being aware?
Or are you saying the device is insecure BUT has no local privilege escalations you can take advantage of as a user?
It means the spyware information flow and Google's ability to remotely modify the device have not been disabled.
It could have RCE but not privilige escalation. But I don't buy it, because 5 years without kernel patches is at least 5 escalation exploits being written by the an llm in 5 minutes
Well, yes? The law says that the bank should do the thing and the bank does the thing to the best of it's ability, given what people usually work there.
> the bank does the thing to the best of it's ability
No they don't. At best, they do a cost-effective proxy for what should be done.
Oh, you have no idea. It's not even about costs. In a 200 year old company the level of corporate disfunction and the average skill level of people is something else entirely. Nothing ever happens unless the regulator holds a blowtorch wired to a timer to the CEO's ass.
> they don't understand what they are talking about
Even though the banks' policies are driven by incident responses and real data, whereas your position is presented on theory.
As someone who worked at a bank - some policy decisions are not driven by regulatory requirements or technical expertise.
Walt looks great. Though I'm not sure I'd trust my financials to a service that posts "Launch dat shit" as a milestone in their roadmap on their homepage.
I actually love that about it. Look at those photo's, what a guy. Contrast this to some "pro" looking vibe coded website, I'll take that guy launching dat shit over that any day.
Why do we trust soulless orgs? Trust this dude who puts his own face on his product!
I'd like to use this moment to praise ING. I have an old tablet running quite modern LinageOS. The ROM is rooted and I use apps that require root accounts. Its almsot only purpose is banking. I don't have banking apps on my main phone.
I have ING app installed on the tablet, the only issues the bank has with it is I get more notifications wanting me to do online training on cyber security or being scammed. I get the same notification every few weeks that my device is rooted and it is "potentially more vulnerable", I can click "I understand" or "Learn more". No other issues, it's not blocking me from doing anything, not forcing any updates, doesn't limit any functionality of the app. Despite my salary is not paid to ING, ING is my main bank. Monzo UK didn't allow me to run on LinageOS on a tablet, Revolut isn't available on tablets at all.
I'm starting to feel iffy about ING, though. They've been pushing their app more and more and I would much rather never need it in the first place.
In all fairness, you can’t normally do shit in the ING app without them warning you that you might be getting scammed, even on modern devices
In Holland, GrapheneOS users are being targeted by police after "busting" a re-seller. The owners of the phones got raided without them being involved in any investigation. Just having the phone was enough to get a knock.
Supposedly the Dutch police had "cracked" their phones.
In Dutch https://archive.is/3wawb
You fell for really shoddy reporting by AD/HLN:
According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.
His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.
https://www.joint-defense-team.com/post/grapheneos-cracked-p...
I don't think the attack can work as described here. One of the features that GrapheneOS lists is:
> Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)
From my understanding, this means that even if you do have the signing keys, you cannot install an update that would remove the need for knowing the screen lock to unlock the filesystem's encryption - as installing such an update requires entering the screen lock first.
But the phones were also under some form of MDM, maybe they could have used that?
To my knowledge this is true for normal android as well (perhaps not that authentication is required); the data is encrypted against the passcode.
This is the issue with being lenient on crime but also being liberal. You have to search for the "right" patterns to find your criminal. It happens that folks who care about privacy, and criminals, two distinct groups search and use the same set of technologies: wether it's grapheneOS, or others. I am also tired of people still looking suspicious at me for not having instagram, snap or tiktok or use whatsapp, it's like I dropped out of society, and that I use linux and use open source email clients/server, I use ublock origin advanced with blocking of scripts and 3rd party domains. Why privacy is an uphill daily battle.
> I am also tired of people still looking suspicious at me for not having instagram, snap or tiktok or use whatsapp, it's like I dropped out of society,
social media was designed to appear like it is society, endorsed by the same people who _made_ the society
i think its all just an illusion to make us work harder :(
> Police were looking for […] Google Pixel phones. These have become popular among criminals in recent years […]. Among others, the murderers of Dutch crime reporter Peter R. de Vries had Google Pixel devices with them during the attack.
This is so braindead, it’s the same as “a black person committed a crime, lets search all black people!”
If someone with an iPhone commits a crime, will they do the same?
You can't decide to stop being black, but you can choose to not buy an iPhone. That's why race is a protected category and your smartphone is not.
And it is not "braindead". EncroChat was a "privacy service", selling phones featuring E2E encryption, disabled cameras and microphones, etc... Even though it wasn't marketed as such, it was mostly a service for criminals. And they effectively searched everyone using these devices (they hacked the firmware), and maybe a few people who weren't criminals got searched, as it happens in many investigations, most people turned out to be. The result was many arrests of people you really want to get arrested, with weapons, murder, torture, etc... being involved.
That's also the reason why mainstream apps like Signal are important for privacy, if only criminals use an app, having that app is a legitimate reason for being suspected. If most people using the app don't really need privacy and it is mostly used to talk about what to eat for dinner, that protects those who really need that privacy. And yes, it includes criminals, unfortunately, so it is actually a good thing for society when criminals use their own communication channels instead of using mainstream ones, good thing most of them are not so smart.
There is an actual Peter de Vries? Is that a coincidence? Or something Frank Herbert deliberately put in?
Peter R De Vries was a prolific crime reporter / journalist who did exceptional work in the Netherlands for many years until he was murdered in cold blood.
The reference: https://dune.fandom.com/wiki/Piter_de_Vries
de Vries is one of the most surnames in Holland. It literally means "from Frisia (the modern day dutch province of Friesland)".
So Peter de Vries is effectively the dutch equivalent of John Smith.
I guess, though John Smith would more literally be Jan Smit, and the surname de Vries might be a name more like North or York.
What it boils down to is that governments tend to prefer that the tools people have available to them are limited in capability.
iPhones and Apple systems in general are the most locked-down phones on the mainstream market, so very government-friendly in that sense.
It's why I'm always slightly disappointed to see developers using Apple systems. They're a far cry from the systems that Steve Wozniak originally built.
The response from EPI/Wero in that thread is troubling:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
I thought that one of the goals of Wero was to become less dependent on US technology (Paypal). By requiring you to use either Android or iOS it seems to me as if that is more of a marketing ploy than anything else. As multiple other banks that support Wero however run on non-Google Android I think it is more likely that whoever wrote that message just doesn't know what they are talking about.
There will be no independence of US tech as long as everyone in europe has google or apple in their pocket and most administrations have windows on their PC. But, at least in germany, ruling parties are very slow to notice this.
We had Nokia, destroyed by Microsoft back in early 2010s.
They destroyed themselves by missing the window for starting an entirely new smartphone ecosystem. They should've either released Lumia years earlier before the iPhone/Android duopoly got established, or made their OS capable of running Android apps (e.g. by being Android).
Exactly. I'm very disappointed in Wero, and I hope they really start working on support for other OSs.
This is a continent that thinks they should run everything on Azure...
Hey, let's be fair here. Wero uses AWS instead! ;)
source: https://www.heise.de/en/news/Sovereign-payment-service-Wero-...
Just how it goes, vote with your wallet.
My mortgage was with a bank that had a website but no app and I was happy, and then they merged with another bank and only had an app and no website and I was not at all happy (but the bank they merged with also had their own mortgage product with both app and website and I do not know why they didn't migrate to using that platform). I swiftly moved to a bank that incidentally had a lower interest and both a competent app and website, and I noted to the previous merged bank that the reason I was leaving is that they did not accommodate me. Whether that feedback was heard, I'm unsure.
Not an option if all banks follow suit. If this trend continues you would only switch to a bank who hasn't yet locked down their app yet.
Hopping banks is easy for just savings, but a lot of work and inconvenience for your standard payment accounts, and that's ignoring additional services like mortgages and insurance.
Indeed. It also fights symptoms rather than the underlying issue - that Google Play Integrity is an anti-competitive method that Google uses to shut out competition. The fact that Google-certified phones that are months behind on critical security updates (or even have malware in there updates as a recent case) do get a pass, shows that it is not really about security, but about destroying competition in the smartphone ecosystem as early as possible.
The solution is not voting with your wallet, but either leveraging the DMA or drafting new laws that counter this.
Either Google should be forced to approve secure alternatives like GrapheneOS or companies should be required to also implement AOSP attestation. Or alternatively, remote attestation should be banned completely, but I can understand the argument that it serves some legitimate uses.
I filed a complaint at ACM (Dutch authority consumer market) about this a while ago since you need to be a google partner to be approved and that is anti competitive. They were very interested in this and even asked for a follow-up. I think they have an open issue about this. So it is a good idea to contact your national authority.
I love how people think "vote with your wallet" is an option on most "vote with your wallet" issues. If people could vote with their wallets they wouldn't have to, would they?
Vote with your vote for politicians for common sense regulations that favor the consumer at the expense of everything else.
This is how it should work, but not how it does. Dutch banks don't pass down increases in interest rates simply because the risk of losing customers is so low [1]. Dutch consumers don't want, can't be bothered, or have such loyalty to their bank of choice, that even a criminally-low rate won't convince them to switch bank
[1]: https://www.acm.nl/en/publications/acm-savings-rates-lag-beh...
Savings rates on all savings accounts are useless. Rabobank even has a managed passive investment account that functionally works like a savings account if you really don't want to use funds yourself [0], I think ING does too. If you do use funds or invest otherwise it doesn't matter which bank you use.
0: https://www.rabobank.nl/particulieren/beleggen/rabo-beheerd-...
Dutch consumers don't want, can't be bothered, or have such loyalty to their bank of choice, that even a criminally-low rate won't convince them to switch bank
It is also just very hard in practice. A lot of people have their mortgages, savings that are locked for years, etc. at a bank. Also, switching a bank also impacts other family members if you have shared accounts, etc.
In this particular case it's also not fully clear yet whether Wero is starting to enforce this. If that happens to be the case, it's only a matter of time before other banks also start requiring Play Integrity for Wero transactions.
It's not hard to just move your savings. A lot of people do that actually; just keep the standard banking account for daily payments and all other services, and put savings in bank-managed ETFs, time deposits, or savings accounts with other banks (I do all three).
It's not hard to move your savings but due to some "coincidence" all Dutch banks keep their interest rates within a very narrow band (some advertise with higher interest rates you get for 6 months). Dutch people are very averse to banks outside of the country due to the icesave affair and not trusting that for example Estonia or Italy will actually be able to make them whole in case of a crisis. So in the end are you moving your money from Rabobank to Andolubank (whoever they are) for 0.3% more interest? Probably not.
Reminds me of the tweet i saw: "My bank, who passed all 14 interest rate increases on to my mortgage, and none of them on to my savings account interest, is currently sending me tips on how to spot financial scammers"
> vote with your wallet
That's not good enough, you also need to convince regular people to do the same. Your vote alone will not achieve anything.
It was heard and will be taken into work around 2030 once we stop embargoing MCP as a dangerous technology
The good news is: no need to stick to expensive and crappy Dutch banks. Plenty of foreign options.
I've completed my transfer this year. I am waiting a few more months to close my Dutch bank account (with the parent company of ASN). Good riddance.
If Wero becomes the pan-european solution for online payments it is slated to become, then no European bank will be exempt from this. Given that as a European your government covers up to €100,000 placed at any European bank in case that bank goes tits-up, you are likely to end with a European bank in any case.
> If Wero becomes the pan-european solution for online payments
It most likely won't, because people want the security that cards offer when they order online. Wero could be good or even great for other things, but not for making online purchases from another country.
The Dutch do nothing but use Ideal, Wero's predecessor, for online purchases. People very much want to simply transfer money from their bank to a shop, just as they can with a debit card. Most Wero transfers will be to shops in your own country, but don't underestimate its potential. Valve offers Ideal on Steam, and has done so for years now, and they can probably give some very appealing insights into how that unlocked a massive amount of gamers in the Netherlands.
Nobody is worried that Valve isn't going to deliver what you purchase on Steam. Likewise few people are worried that they're going to be scammed by a well recognized national brand. That's why I specifically mentioned cross-country online shopping, where methods like Wero which offer no benefit at all to customers will have difficulties finding success. Unless there's a massive media campaign to tell people what they should do.
Shopping online beyond the national borders is a fraction of all shopping done online, and when it is done, people gravitate to big platforms like Amazon or Steam.
What Wero will do, is allow a German citizen to order stuff in a German shop, and an Italian citizen to order stuff in an Italian shop first and foremost. After that, it will allow them to pay for stuff on Vinted (people already buy second hand clothes across borders this way!) or Steam.
It will also make buying stuff in different European countries easier, but that is only a tiny percentage. The winners here are citizens being able to shop around further, and shops with dedicated national versions of their store to sell stuff easily to citizens in whichever country they decide to port their shop to (in addition to simply serving those who are fine with their shop in English or another language).
If you only know credit cards, you won't see the benefit, but Europe is predominantly a place of debit cards and local payment methods.
What are you switching to?
you can't just open bank account in the country where you don't live
> is troubling
No, it is not troubling, it is realistic for a service with high expectations and reliability expected, on tight schedules/resources
Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
Wero is a standard that is implemented by each bank. The requirement can come from Wero, to be implemented technically by your bank.
I already addressed this in my comment:
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
Just the fact the method is namespaced under nl.devolksbank doesn't have to mean anything. Could just be vendored code.
Migration from ideal to wero was a change of a logo.
That's their "Phase 1". They are currently building new infra. My ASN bank app just yesterday actually wanted me to go through some reauthentication flow for migrating to Wero so maybe they are actually moving to that now.
Always install these apps and negatively review them, specifically mention banning of GrapheneOS, there is absolutely no plausible reason for that.
I get banning rooted devices and unlocked bootloader (despite I disagree of them being ground for banning), but GrapheneOS left no possible excuse to anyone.
Why is banning rooted/unlocked devices even necessary, I assume it's about concern for fraud but shouldn't all transactions happen server side anyway?
Because if you're not pre-compromised by somebody who will prevent you from behaving badly, they can't be sure you're not behaving badly.
And by behaving badly I mean using a client other than the one they expect to talk with their server.
Imagine if there was just one banking app, and whichever bank it talked to was just a setting, sort of like how pidgin and trillian worked with chat back in the day. That would make the banks feel small. You can't have control over your device because it might hurt their feelings.
I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
Just a heads-up from a fellow Pixel 6 owner: it has reached end-of-life last month, because the five years since the launch in October 2021 are up. Better start looking for a replacement soon.
Why would someone want a replacement just because someone else tells them their hardware has reached end of life?
Because there will be no more security updates of firmware, drivers, kernels, etc., all while there are monthly high/critical CVEs.
What prevents you from building an up-to-date Lineage version for old hardware? It isn't exactly difficult with Claude now.
Something which in the context of a thread about banking apps seems quite relevant too.
If they banned all outdated roms why not but you can use all the banking apps on something not updated since 2019 if it's stamped by Google
I'm sure that will work for a while, but that doesn't solve the problem of that banking app sitting on an unpatched OS.
My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits.
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.
This will keep happening so long as GrapheneOS is a "niche" operating system. We need to build up economic leverage by increasing GrapheneOS usage numbers until they can no longer afford to block it.
An OS available either for one Google product line or for a phone costing over 1000€ from Motorola, will never reach usage numbers high enough to change corporate policy on business grounds. (It may happen some executive within the company is just sympathetic to libre software even where there are no business pressures, but that's a long shot.)
Anyone who has been around in the free-phone community in the last decade-plus would recognize such idealism as mistaken and never once borne out in practice.
Isn't Motorola releasing phones with GrapheneOS next year? It should vastly increase the number of users.
They are releasing a phone with official GrapheneOS support, but the operating system has to be reflashed by the user, and this phone will cost around $1,700.
Yes, but that's still a massive improvement. The phone will be much better than Pixels, and unlike Google, Motorola is actually capable of selling the phones worldwide.
It will be compatible but it won't come stock as they would breach their Google license (which is why you never see or never saw a pre-rooted phone sold by any official brand)
It is! I'm gonna buy it as soon as it comes out.
Many people here are missing what the business model of banks is, they're in the business of creating absolute trust with their customers, as soon as that evaporates, the banks stops being viable. That means eliminating any (perceived) risk, whether real or not. From the banks perspective this move reduces the attach surface thereby reducing risk which is worth the tradeoff of an inconvenience to the 1% of people that would even care about this move.
How is GrapheneOS a bigger risk than a stock Android missing 3y of security updates?
Given that all these banks happily accept the latter, we can conclude that they do not actually perceive any of this as a real risk. Ergo, something else is going on (eg incompetence)
Also, an owner of a grapheneOS phone is not going to perceive it as greater risk, and an owner of a non-grapheneOS phone is not going to give a shit either way whether they support an additional OS.
I remember my bank requiring to install a com plugin to use it, limiting it to windows. Later they moved to java applet limiting it to Linux 32-bit for some reason. Mostly it would not work on my hardware
This is a result of the duopoly. You abdicate too much responsibility to the platform because it is easier for you. It ends up in a spiral of more lock-in to the platform and more power to its owners.
We need at least a third option [1].
[1] https://blog.ovalerio.net/archives/3359
GrapheneOS merely needs more users, so that there is more pressure on banks and other app devs to support these (or, to pressure Google in return for a more agnostic integrity check).
I therefore welcome the Motorola initiative to support GrapheneOS, but it would be even better if devices were sold with it, and even better if there were devices for multiple price points.
Does GrapheneOS even want more users? grapheneos.org does not look like a website that's trying to build up a large userbase or like it's trying to appeal to the general population.
The first thing the majority of people care about is what the OS will look like on their phone if they install it. There's not a single image of what will appear on my phones screen once I'm running GrapheneOS - that's a huge turnoff for the vast majority of people.
Compare that to apple.com/os/ios where the first thing your eyes rest on is a picture of a phone showing you what the OS looks like. Same deal for the features tab on android.com - they're showing you the features, not just giving you technical documentation for them.
If they do actually want to grow the userbase, there is a lot that needs to change - more than just getting bespoke deals to be supported on $1500+ small marketshare phones.
Recent suggestions of having screenshots for the new messenger app might give the answer. The official replies were "our users try out the new version directly instead of looking at static images of it" and that "a video would be needed" (links below)
Regardless, the developers are very experienced and smart, and know that screenshots are often used to advertise a product, so I guess it's a very conscious choice.
https://news.ycombinator.com/item?id=49669944
https://news.ycombinator.com/item?id=49669684
I have an refurbished iphone sleeping most of the time in my desk drawer, used only for banking apps.
It also make me feel safer not to have always on me the key to all my accounts.
Things like iDeal (wero) require you to use a banking app for most online purchases
Also, Wero is going to be used for tap-to-pay in stores (initial roll-out planned for 2027). Carrying a second phone is going to be old pretty soon. Also, I think we should fight this on principle.
For tap-to-pay you're fucked anyway if they chose to rely on Google pay.
At the risk of being called a dinosaur, did you consider using a bank card?
How do you think I'm paying for stuff?
It's not like I have much choice.
As a rare counterexample, Starling Bank in the UK has acknowledged and fixed updates breaking functionality on GrapheneOS multiple times.
I really don't understand this as all of these banks are reachable from a browser anyway, without any checks or guarantees about the underlying OS.
Most of them require 2FA using their apps
Ah so that is what is been happening. I suddenly lost the ability to pay my friends back last week. They did not tell me anything was about to change. I've been in contact with the service desk for about 4 days now, they themselves have not yet figured out that my e/os s9 is the problem it seems.
Time to switch banks again I guess?
It should become illegal for these kinds of institutions to block access to random devices without reason. How does the EU want to be self sufficient if even accessing your bank relies on an American advertising company? Everything is being digitized, yet nothing has ever been as unusable as it is now
They have a reason. It's difficult to support while maintaining the security standards they want.
What should be illegal is wanting to make every niche pet peeve of yours illegal
I was done with Android when I couldn't take screenshots of my Revolut/bank app/other apps. So far, iOS hasn't had a problem with this. Is it less secure, then? No, it was never about security, just control.
Is there a list of banks per country that do not, and never will, require Big Tech devices to do basic actions with a bank account?
Feels like we have enough motivated and skill people to do and maintain that.
There is a list maintained by Graphene and community about Graphene OS compatibility:
https://github.com/PrivSec-dev/banking-apps-compat-report
https://privsec.dev/posts/android/banking-applications-compa...
Yes you can still use cheques, credit cards, use ATM to get money and see statements. Many still allow phone banking.
You can go to your branch to do many things as well. (OK fewer people do that so there are fewer branches).
I don't know where you live but a lot of banks do not have physical offices anymore and when they do it is to talk about a large loan, not to do daily operations anymore.
I am in the UK. Yes fewer branches but there is the idea of setting up joint branches in some places where all the high street banks have left.
Those would be most banks with physical offices.
As replied in https://news.ycombinator.com/item?id=50394137 that's not the trend I see, namely less physical offices also.
The EU's push for digital sovereignty will win out over stuff like this in the end. They're going to want a European vetted version of Android. At least if I were European, that's what I'd want.
Dont take the fact that Wero still works for Bunq as an indicator that ASN or any other bank are doing something especially untowards.
Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.
Yeah for now I use bunq + CurvePay for tap to pay (since Google Pay also doesn't work on Graphene).
Let's see how long they let me keep it.
I can't take bunq seriously because every time I approve a direct debit I keep seeing two transactions in the log -- one already processed and another still pending and also asking me to enter the pin again after it was approved.
Peak clown computing.
Some ~4 years ago i had the iOS app. It would open without touchid or a passcode. It would execute transfers without a PIN or biometrics.
Leaving your phone unlocked basically meant someone could drain your account.
I reported it, zero response. Bunq, not even once.
Sounds like a bunq, yes
Two of my credit unions (the only ones I tried) 'stealth block' this by refusing to accept checks I try to take pictures of. It will just refuse to work with a no descriptive error message. These are large credit unions.
One one hand with all the fraud and identity scams I know they have a difficult job. But, on the other, they also rely on sending me txts to login-no proper 2fa like TOTP security codes.
ASN was pretty bad - they recently wanted me to renew KYC/ID info. They wanted to install a Chrome Plugin that then would read the government KYC data. I nope'd out of that very fast. The alternative indeed was an app.
I think we really need an open hardware signing authority for open-source roms like GrapheneOS.
We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.
GrapheneOS does have their own device attestation sdk
Imagine the outcry. That would go against everything OS stands for, wouldn't it?
If you are a bank, you want to have an authority that guarantees OS hardware signing of a smart phone.
But this authority could be a bunch of cool people like Letsencrypt, instead of only Google.
OS isn't a co-ordinated movement with a single set of values.
I'm not in the android rooting / modding scene anymore, but isn't there just a way to install a (Magisk?) module or something to spoof the Safetynet check anymore? I'm not saying that is a great idea, just in my memory theres workaround for this kinda thing.
There are two different Safetynet check levels. One (BasicIntegrity) is easily spoofable, bug GrapheneOS already passes that. The other requires Google certification.
Not possible, you have to run a OS signed by Google.
At this point I'm willing to have a second Android phone at home which is controlled by a robotic finger that I connect to from my GrapheneOS phone.
So we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
Wero is an initiative introduced by the banks, not by the EU government. They specifically lobbied to make the "digital euro" initiative much worse so that it doesn't compete with Wero. So it makes sense that Wero has the interests of the banks in mind.
I have noticed zero change in using iDeal / Wero since the rebrand.
iDEAL | Wero was just a rebrand of iDEAL to make people get used to the new name Wero. The actual Wero roll-out has only just started. ASN and Bunq seem to be the first Dutch banks to actually roll out Wero (and not just renaming iDEAL to iDEAL | Wero).
ABN Amro also seems to be rolling out changes. I can't tell if it is just front end, but they did break some stuff. Including, annoyingly, making online payments without a phone.
The situation changes every couple of months, can't figure out if they unbroke it already.
Exactly. We are currently in a transition phase (of about a year iirc) where, for example, the fee will stay fixed. After that it will be a percentage of the total amount. Which is why Mollie announced[1] they would be launching a Wero alternative.
In the end this whole "buyer protection with percentage fee" is about the banks thinking: "We don't want to be a dumb digital sock for people's money. We have to provide value to them". But I want my bank to be a dumb digital sock to put my money in, nothing more. I'm really getting fat-up with all these MBA-types's thinking their company "needs to have a relation with me and add value". I mean I get emails from my utilities trying to get to know me. Seriously? I don't give a wooden nickle about my drinking water supplier. I just want to pay them and use their services and other than that I want to think about them as little as possible.
[1] https://www.accountant.nl/nieuws/2026/10/betaalbedrijf-molli...
From the write-up, it looks like mollie will be using PSD2 Payment Initiation Service (PIS). Which is exactly what PSD2 PIS was meant for. Kudos to them.
Wero is a mess.
The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can't be mitmed when the system trust store is manipulated
The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.
I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem
This company is a joke. True story: someone working in their AI department told me they all got fired because AI is bad for the environment.
> To maintain that level of quality, we also need to be clear about our system requirements and avoid dedicating resources to troubleshooting issues on unsupported platforms and configurations.
This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue.
One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on.
But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.
I thought the take money out of someones account was just an issue in USA.
UK definitely and I thought EEC banks use a different system that stops that.
It used to be common in Germany to order things (e.g. per mail order catalog) by giving your name, address and account number. I think it is still used when signing up for services. And "SEPA direct debit mandates" are still popular.
But in UK and I thought EU if a direct debit is wrong the Bank has to refund it.
ASN has been dysfunctional for years. They needed a bailout and ever since have only deteriorated in their operations. To be fair, their risk management has surely improved and their new CEO is great. But their actual operations are superbad. They only do the easy loans and mortgages because anything else they can't do. Still I think as a bank they are doing well, everyone is opening accounts there. Marketing matters more than service I suppose.
“Needed a bailout” is putting it mildly. ASN bank is 100% owned by the state since the got in trouble (like 90% of other Dutch banks).
It's a bit outdated. The big green one isn't in the government majority ownership for a year and some now, so we installed back those glass shelves and cocaine dispensers in all restrooms by now.
Yes, the state is divesting from ABN AMRO (and apparently making a profit on it) but ASN is still 100% owned. I think Rabobank was the only one of the big banks that did not need state sponsorship. Probably due to the fact they are a cooperation and don't have shareholders to please.
Well, at least their CAO is re-negotiation on time then I guess.
If you change phone operator, there is number portability. But changing banks is a lot harder.
The EU could do what the UK did, which is making switching bank bank account automated for people (transaction forwarding, migrating direct debit authorizations, etc.). A lot of people might switch to more competent banks. I'm stuck with Deutsche Bank in Germany, for example. Switching would be a bit of a hassle. I'd have to make sure all the direct debit stuff gets changed to the new account (tax office, various insurances, etc.) all doable but it's a bit of friction. I'd be chasing different companies with forms, emails, etc. for a while.
There are a lot of user hostile banks that deserve to lose their customers because of their ineptness. The surviving ones would probably become a lot more service friendly. That's what competition does. German banks are particularly bad. I've lived in other EU countries. So, I have hands on experience with more competent banks.
Kinda exists already in the Netherlands: https://www.overstapservice.nl/deelnemende-banken/ .
While no longer popular, decentralized banking via cryptocurrency/digital currency would have made unilateral access issues impossible.
Want to access your wallet on the chain? The tech doesn’t give a shit about what device you use. Just present the private key to wallet and access funds.
But alas the tech never took off beyond grifters/scammers and speculators use case. Also, people would rather trade the promise of safety that centralized banking promises (deposit insurance, regulations, access to person that may help resolve lock out issues, …).
Other European banks do it, too - N26 also rejects GrapheneOS.
N26 works fine on GrapheneOS for me.... but I see there's a note saying:
> This app has started using Play Integrity to block new signups, existing accounts continue to work fine for now.
https://privsec.dev/posts/android/banking-applications-compa...
Fwiw, also for me N26 works, have had the account for years now, but installed the app a couple of weeks ago (when I got my Pixel 10 with GOS.)
Maybe during registration, but not during use.
The title sets a lot of blame on the bank, but there might be other factors at play. It is possible that either national or european regulations or laws makes it mandatory for the banks to comply with a set of security features that makes it impossible for them to offer services to degoogled phones. There might not be any alternative because it would cost too much money to develop and more importantly to distribute it. It can also be the case that Google uses its influence over the android open source project to make sure it will never be the case.
There might not be any alternative because it would cost too much money to develop and more importantly to distribute it.
https://grapheneos.org/articles/attestation-compatibility-gu...
If Wero (assuming it's Wero) can push banks to implement Play Integrity, they can also make some guidelines or make a small SDK to for AOSP remote attestation. It's not terribly hard to implement and some banks already do.
I don't think there is an actual written regulation that talks about attestation or SafetyNet.
I can imagine in some meeting with the ministry or an industry association that somebody in charge said "implement all safety measures that Google and Apple provide, no excuses" and they just execute it.
I could also imagine there is a real need to do so. Maybe somebody found that criminals use rooted phones to robotically launder money or something like that. Or there was a criminal case where someone got a bank account with a fake ID and used it on a burner phone. Then the developers get a discrete notice from law enforcement or regulatory bodies and are told to close that gap. Who knows?
Luckily, Triodos (the other idealist bank in the Netherlands) still has an app that runs on Grapheneos.
Unfortunately Triodos has strong ties to the anthroposophy cult
https://steinermentary.com/steinerlens/triodos.html
No. It may have been part of the founding of the bank back in the day, but I worked an intensive five years at Triodos and this is the first time I've even heard that word. No one I worked with or saw in the organization was related to that movement. It was clear to everyone there that as a bank we focus on providing a service that is socially positive for the community, and the people there did take that very seriously, but from what I've seen Dutch society has that to some extent embedded in its fabric.
I believe you that regular employees are not a part of this, and if it were just something the CEO believed I wouldn't care. But they use customer funds to fund ahtropospohical institutions. See, for example,
An anthroposophical pseudomedicine center:
https://www.triodos.nl/projecten/gezondheidscentrum-de-lemni...
An anthroposophical school:
https://www.triodos.nl/projecten/steinerschool-michaeli
Those aren't some old examples that I had to dig deep into the bank's archives to find, theyre just two examples of grants that are highlighted on their website right now. You and your colleagues probably weren't related to anthroposophy, but the management and the funding decisions definitely are.
So stop using the application on your smartphone. Just use your desktop computer, and if they block that start going into the bank and make them pay real people at their real physical locations to do the work. Or use your phone to call them and do it over voice. Don't just give in and let them monetize you and force you to put insecure software on your hardware (like google play and other corporate controlled backdoors).
Weird enough that nothing I do as a client should be able to compromise security of the bank. This means purely they have dirty under the rug
bye bank
Including the substring "ASN blocks" in the title made that super-confusing at first.
So, what is the reason for blocking GrapheneOS?
Is it legit?
They don't block Graphene directly, they block any phone that doesn't have attestation, which the Graphene phone cannot have. https://grapheneos.org/usage#banking-apps
Basically, GrapheneOS on a phone counts as a "tampered" device.
GOS offers it's own attestation. They just fail to include it.
Question: how do the Amish do banking?
Probably in-person at a branch. However they are allowed to use technology for certain tasks; their elders just have to discuss (and vote?) on it first.
Answer: however we did it before.
Also the Amish are American and the American banking system is a very different (uglier) beast when we are talking about digitization when compared to the Dutch.
So much for european countries wanting to become independent of the USA.
There is no cohesive strategy. It will literally require a new generation of younger people to replace the old lobbyists here - and some of these younger people will become corrupt lobbyists as well.
Open standards should become a human right. I am not kidding. I fail to see why services in a given country, get tied down to foreign companies and foreign countries.
seems we need privacy bank?
There is a long comment history there. Link to the newest breakage:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
To whom it may concern:
There is an alternative to Google's proprietary and unprivate integrity API that every bank now uses (and is at the root cause of this issue):
https://uattest.net
Spread the word.
Nah. Unified Attestation is an initiative by some some companies that really have terrible security (years old kernels, drivers, firmware, often way behind on Android updates). They are also known for campaigns against GrapheneOS, including astroturfing. They also do a fair amount of eurowashing (in particular Volla, who sell UAE/Chinese phones as a European phone with a markup of hundreds of Euros).
If Unified Attestation would become a standard, they would use it to entrench themselves over GrapheneOS et al.
AOSP has an API for remote attestation attestation. Banks should just come up with a list of signing keys to be trusted. Heck, they can start here:
https://grapheneos.org/attestation.json
However, ASN is the only Dutch bank that allows you to open and operate an account without owning and iOS or Android-based smartphone.
All other banks only allow you to open an account via their app.
Certainly not true for ABN AMRO, see "Unable to open an account using the app?". Sounds like someone will come by your house to check your ID.
https://www.abnamro.nl/en/personal/payments/open-an-account/...
Incidentally I was happy to see that while they're phasing out their previous cryptographic identification device (that you put your bank card in) they will still support some kind of cryptographic usb dongle (in addition to smartphones).
Happy to be proven wrong :)
When I wanted to open a second account a few months back, ABN is the only bank I have not tried because, well, I have my first account with them... I could not find similar option with any other, though.
I confirm that ABN AMRO's "Unable to open an account using the app" in the Netherlands is a procedure where a guy comes to your house to check your ID. I found it a really cool thing in terms of accessibility.
Your account appears to be shadowbanned (your current comment is visible because people vouched for it). I'm letting you know since looking at your recent comments I can't see any obvious reason. You might want to use the contact link to talk to hn about it.
Not quite true. All banks really want you to use their app, and the neobanks actually demand it (and get away with it because they are not as important as the so-called system banks).
But look at the pages more carefully, and you'll note that there is a way to open an account using just a web browser too (e.g., look at abnamro.nl). The links are deemphasised by using dark UI patterns of course.
ING is being really dirty about this. It should be possible to open an account, and get the OTP hardware device that reads the chip on the debit card, but they don't document how you can open an account without the app. It's probably possible, as existing customers can bank without the app, but you will probably have to call them.
Banks would love to get rid of all those nasty people without approved smartphones, but that would cause political pushback.
Thats simply not true. If I want to open an account I can go to a Rabobank office and open an account. There are still plenty of Rabobank offices around. I can also access all features (even pay with Wero / iDeal) via my Rabobank scanner on my desktop via their website.
> All other banks only allow you to open an account via their app.
TIL all Dutch banks (except ASN) closed all their branches and you can't register new account in the branch, what a progressive society it must be...
That's not true. I opened my ABN AMRO account in their branch last year.
Well guess why they do that, they're not taking your freedrums, Americans, this is a legitimate anti fraud framework step, dont ask, I work in payment processing.
This.is.a.good.decision
The EU banks are mandating that all their systems be backdoored by Google.
Trump has started forcing US companies to deplatform people in Europe that he does not like. This is not a legitimate anti-fraud step.