alt Hacker NewsDutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS
Comments
My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years...
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess? Not how I'd architect it...
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
[0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe...
[1] https://walt.is/
I'd like to use this moment to praise ING. I have an old tablet running quite modern LinageOS. The ROM is rooted and I use apps that require root accounts. Its almsot only purpose is banking. I don't have banking apps on my main phone.
I have ING app installed on the tablet, the only issues the bank has with it is I get more notifications wanting me to do online training on cyber security or being scammed. I get the same notification every few weeks that my device is rooted and it is "potentially more vulnerable", I can click "I understand" or "Learn more". No other issues, it's not blocking me from doing anything, not forcing any updates, doesn't limit any functionality of the app. Despite my salary is not paid to ING, ING is my main bank. Monzo UK didn't allow me to run on LinageOS on a tablet, Revolut isn't available on tablets at all.
In Holland, GrapheneOS users are being targeted by police after "busting" a re-seller. The owners of the phones got raided without them being involved in any investigation. Just having the phone was enough to get a knock.
Supposedly the Dutch police had "cracked" their phones.
In Dutch https://archive.is/3wawb
The response from EPI/Wero in that thread is troubling:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
Always install these apps and negatively review them, specifically mention banning of GrapheneOS, there is absolutely no plausible reason for that.
I get banning rooted devices and unlocked bootloader (despite I disagree of them being ground for banning), but GrapheneOS left no possible excuse to anyone.
I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
I remember my bank requiring to install a com plugin to use it, limiting it to windows. Later they moved to java applet limiting it to Linux 32-bit for some reason. Mostly it would not work on my hardware
My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits.
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.
Many people here are missing what the business model of banks is, they're in the business of creating absolute trust with their customers, as soon as that evaporates, the banks stops being viable. That means eliminating any (perceived) risk, whether real or not. From the banks perspective this move reduces the attach surface thereby reducing risk which is worth the tradeoff of an inconvenience to the 1% of people that would even care about this move.
This will keep happening so long as GrapheneOS is a "niche" operating system. We need to build up economic leverage by increasing GrapheneOS usage numbers until they can no longer afford to block it.
This is a result of the duopoly. You abdicate too much responsibility to the platform because it is easier for you. It ends up in a spiral of more lock-in to the platform and more power to its owners.
We need at least a third option [1].
GrapheneOS merely needs more users, so that there is more pressure on banks and other app devs to support these (or, to pressure Google in return for a more agnostic integrity check).
I therefore welcome the Motorola initiative to support GrapheneOS, but it would be even better if devices were sold with it, and even better if there were devices for multiple price points.
Ah so that is what is been happening. I suddenly lost the ability to pay my friends back last week. They did not tell me anything was about to change. I've been in contact with the service desk for about 4 days now, they themselves have not yet figured out that my e/os s9 is the problem it seems.
Time to switch banks again I guess?
I have an refurbished iphone sleeping most of the time in my desk drawer, used only for banking apps.
It also make me feel safer not to have always on me the key to all my accounts.
As a rare counterexample, Starling Bank in the UK has acknowledged and fixed updates breaking functionality on GrapheneOS multiple times.
I really don't understand this as all of these banks are reachable from a browser anyway, without any checks or guarantees about the underlying OS.
It should become illegal for these kinds of institutions to block access to random devices without reason. How does the EU want to be self sufficient if even accessing your bank relies on an American advertising company? Everything is being digitized, yet nothing has ever been as unusable as it is now
I was done with Android when I couldn't take screenshots of my Revolut/bank app/other apps. So far, iOS hasn't had a problem with this. Is it less secure, then? No, it was never about security, just control.
Is there a list of banks per country that do not, and never will, require Big Tech devices to do basic actions with a bank account?
Feels like we have enough motivated and skill people to do and maintain that.
The EU's push for digital sovereignty will win out over stuff like this in the end. They're going to want a European vetted version of Android. At least if I were European, that's what I'd want.
Two of my credit unions (the only ones I tried) 'stealth block' this by refusing to accept checks I try to take pictures of. It will just refuse to work with a no descriptive error message. These are large credit unions.
One one hand with all the fraud and identity scams I know they have a difficult job. But, on the other, they also rely on sending me txts to login-no proper 2fa like TOTP security codes.
Dont take the fact that Wero still works for Bunq as an indicator that ASN or any other bank are doing something especially untowards.
Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.
ASN was pretty bad - they recently wanted me to renew KYC/ID info. They wanted to install a Chrome Plugin that then would read the government KYC data. I nope'd out of that very fast. The alternative indeed was an app.
I think we really need an open hardware signing authority for open-source roms like GrapheneOS.
I'm not in the android rooting / modding scene anymore, but isn't there just a way to install a (Magisk?) module or something to spoof the Safetynet check anymore? I'm not saying that is a great idea, just in my memory theres workaround for this kinda thing.
So we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
> To maintain that level of quality, we also need to be clear about our system requirements and avoid dedicating resources to troubleshooting issues on unsupported platforms and configurations.
This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue.
One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on.
But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.
ASN has been dysfunctional for years. They needed a bailout and ever since have only deteriorated in their operations. To be fair, their risk management has surely improved and their new CEO is great. But their actual operations are superbad. They only do the easy loans and mortgages because anything else they can't do. Still I think as a bank they are doing well, everyone is opening accounts there. Marketing matters more than service I suppose.
At this point I'm willing to have a second Android phone at home which is controlled by a robotic finger that I connect to from my GrapheneOS phone.
If you change phone operator, there is number portability. But changing banks is a lot harder.
The EU could do what the UK did, which is making switching bank bank account automated for people (transaction forwarding, migrating direct debit authorizations, etc.). A lot of people might switch to more competent banks. I'm stuck with Deutsche Bank in Germany, for example. Switching would be a bit of a hassle. I'd have to make sure all the direct debit stuff gets changed to the new account (tax office, various insurances, etc.) all doable but it's a bit of friction. I'd be chasing different companies with forms, emails, etc. for a while.
There are a lot of user hostile banks that deserve to lose their customers because of their ineptness. The surviving ones would probably become a lot more service friendly. That's what competition does. German banks are particularly bad. I've lived in other EU countries. So, I have hands on experience with more competent banks.
Other European banks do it, too - N26 also rejects GrapheneOS.
The title sets a lot of blame on the bank, but there might be other factors at play. It is possible that either national or european regulations or laws makes it mandatory for the banks to comply with a set of security features that makes it impossible for them to offer services to degoogled phones. There might not be any alternative because it would cost too much money to develop and more importantly to distribute it. It can also be the case that Google uses its influence over the android open source project to make sure it will never be the case.
Luckily, Triodos (the other idealist bank in the Netherlands) still has an app that runs on Grapheneos.
So stop using the application on your smartphone. Just use your desktop computer, and if they block that start going into the bank and make them pay real people at their real physical locations to do the work. Or use your phone to call them and do it over voice. Don't just give in and let them monetize you and force you to put insecure software on your hardware (like google play and other corporate controlled backdoors).
So much for european countries wanting to become independent of the USA.
There is no cohesive strategy. It will literally require a new generation of younger people to replace the old lobbyists here - and some of these younger people will become corrupt lobbyists as well.
Open standards should become a human right. I am not kidding. I fail to see why services in a given country, get tied down to foreign companies and foreign countries.
Weird enough that nothing I do as a client should be able to compromise security of the bank. This means purely they have dirty under the rug
bye bank
Including the substring "ASN blocks" in the title made that super-confusing at first.
So, what is the reason for blocking GrapheneOS?
Is it legit?
seems we need privacy bank?
There is a long comment history there. Link to the newest breakage:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
To whom it may concern:
There is an alternative to Google's proprietary and unprivate integrity API that every bank now uses (and is at the root cause of this issue):
Spread the word.
[flagged]
[flagged]
[dead]
[dead]
SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.