> if a major regulator like EU steps in

Even if they did, I feel the result will be the opposite of what you expect. EU own reference implementation of eID relies upon Play Integrity [0].

[0]: https://github.com/eu-digital-identity-wallet/eudi-app-andro...

> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.

"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.

There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.

Why would banks be motivated to care? People just give them money as a business model. Up until recently, Wells Fargo didnt have case sensitive passwords even, because no pressure to do anything about that.

To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.

It wansn't a mistake, it was a deliberate attack on the user, i.e. malware.

> But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".

> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.

Mostly the government forces them to do this. If the capability did not exist it wouldn't be mandated or used. Think about this whenever someone tells you "just don't use it if you don't like it", about everything.

I don't know if there is a common API standard from a technical point of view, but there is the legal framework for it. Banks in the the EU have to provide an access to third parties who provide account information services to clients (themselves being regulated and supervised by a national agency). I would assume because it is mandatory, it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.

The issue is weird. Banking is both conservative and on the lookout for new way to make things complicated, but one dumb executive --usually-- can't derail the entire bank, because there are enough stops in place. This is one of the reasons US banking is such a ridiculous mix of various integrations of a line of executive decisions resulting indirectly from lunches with said executives.

> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which always include all of the user hostile bullshit you mentioned.

It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/

The only way this can NOT happen is if someone quite senior signs off on the risk, who would have to get in a big fight with the cyber/policy teams for basically no benefit to themselves. They would also have to be unusually technical and pro freedom to even understand the issues, which is not the typical personality profile of the kind of executive who ends up with overall risk authority for a bank's mobile app.

If there wasn't SafetyNet it'd be something else, probably per OEM like Knox which would be worst.

My previous bank app (HSBC) detected that I'd jailbroken my iPhone, and warned me, but allowed me to continue at my own risk, which I appreciated

Instead of asking the government to fit all banks' products to your preferences, you could just use a bank that fits your preferences.

I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).

> banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it"

Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.

Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.

> forces banks to provide access through a common API standard

Doesn't PSD2 already provide this?

> By now

Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.

As Dunning said and Marx quoted:

> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."

> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.

You mean like HTTPS? It's a shame that mobile banking website have fallen out of favor.

I'd really love to see your banking app that works differently and cannot super trivially be attacked by malicious software. Can you show us your example of such an app? It might be helpful to show tha validity of your arguments.

Sounds like Open banking

The worst part is: you can't escape them.

You need to have a bank account to live a life outside the woods.

I have multiple bank accounts, because I am a solopreneur, yet all of them are weird in their own ways

People need to stop calling for the EU "to step in", they already have and made everything worse. They forced PSD2 with """"""""""""""Open Banking""""""""""""""" which requires convoluted requirements and is regulated to death so no private person can call the API themselves and get e.g. their balance or transactions.

I saw my bank embedding a keylogger and it was even scrapping the password entered to login and basically slurping everything done on the page to an external domain. I checked with the bank and they said these were their analytics and nothing to worry...

I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.

the alternative is letting binance give your money to north koreans.

It's a very difficult set of choices.

Much better - enforce that every bank that has app has a website and feature parity between both.

And that common API would require safety net too. Banks and the government are the same thing: the enemy of of free computing.

SafetyNet indeed was and it was not a mistake. Mistakes are bugs, a company doing things they didn't want to do, or didn't intend to have the effect it later had.

Banks on the other hand, as much as hateable (most of them are), also just shit bricks at mere thought of one regulatory spanking, not only hammering from their boards and shareholders (esp. the major ones). So – it might be a great idea to not shit on banks shitting on such choices.

Banks are also sacred of making changes and going farther from the "mainstream" and another reason is also because - they handle "real money", often people's entire life-savings.

We just think:

… oh, this OS is soo cool, so safe, let's use this.

… And then notice: goodness, this motherfucking company is not letting me use their app on this coolest and safest shit out there. Burn them!

And banks think:

… shit this one is not part of any common industry standards, let's stay the fuck away from it.

… Further: ha, authorities don't look kindly on this OS, let's stay extra away from it.

… And more: will this mean we have to support one more standard, one more release channel, one more modified OS? Anyone who mentions name of this OS again will thrown out of the window of highest floor of our HQ (and mind it, we are on 33rd already).

Solution (one of the) is forcing Googles and Apples to stay open, to stay respectful of user privacy in an absolute and transparent manner, to not let them implement closed-off protocols, to have APIs that is not availalbe to everyone – in a safe manner, not let them (and the politicians and security agencies) fear-monger the public like "think of the children" etc. Blaming banks is literally barking up the wrong tree – esp. in this context.

Another way is: not buying these devices and suffer the pain (and experience the bliss, yes!) and then hope/work for this number to increase and collectively point a thick and long shimmering hot rod (metamorphically speaking) at the hinds of such companies (hell, include the banks as well – so that they won't fuck up their desktop and mobile portals) so that they collectively feel the heat and are forced to bend (no metaphors here!). But no, we won't let go of our annual pleasure of this practically bullshit <First Time on an X>™ orgasms.

tl;dr: SafetyNet was not a mistake, making something like SafetyNet into the monster it and then making it limited to one company/one publisher (esp. since they are the ones who also control the OS) was the mistake. I think of this to be solveable sometnhing on the lines of multiple certificate issuers (but we have to be careful of eMudhras) - both for safetynets, and app stores (if not combined).

> 120MB APKs full of obfuscated code

Wow, where'd you find a bank with a mobile app that lean? Please share for everybody's benefit! /s

Half a gigabyte of app bundles is unfortunately no longer an outlier...

Nah SafetyNet offloaded a huge chunk of security on Android from app makers to Google/AOSP, it's an excellent system that works great for 99.99% of uses. It's what allows safe and fast banking on Android in general.

EU wants to have as much surveillance as possible, that's their only interest.

> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.