Around a dozen banking apps began specifically permitting GrapheneOS (grapheneos.social)

https://www.wellsfargo.com/biz/online-banking/securid/

How often do you think companies are in the habit of doing things for your convenience?

Not who you replied to, but requiring me to install your app or create an account is usually going to mean I skip your thing unless I'm really motivated (or forced basically) to use it.

For something like a bank, I think they ought to be mandated to offer a functional website, yes. A slick app is nice too, but not if it’s the only option, specifically designed to steal my data and spy on me.

I find that banking apps deserve that extra bit of anger pointed towards them. (It’s also increasingly hard to find an ATM in many countries. What are banks up to?)

No, I don't want to run any apps, particularly commercial ones. I only run a few FOSS apps like K9, IronFox, Signal, Home Assistant.

I have, on occasion, downloaded and tested apps from the Play Store in a separate profile, and my experience of such apps has been extremely negative. Clearly, these apps don't exist for the user's benefit, and their purpose is to extract information about the user, including phone number, location, other apps used, contacts, etc.

I think the HSBC app qualifies as malware but I'm morbidly curious how bad South Korea's version is...

it's so obvious they need backdoor access it's not even funny.

Because unless your desktop is dedicated to banking, there's always the chance that one of your other activities will install malware. If you don't use FDE (the majority of people) and you saved your banking password in the browser rather than a password manager (likely a scary amount of people), then theft is also an issue.

Neither of those things are really a problem on a mobile device.

Exactly, VCRs should be banned -- why should cable companies tailor to you how they do business, and be forced to allow you to plug in anything into their distribution network? Only approved TVs should be an option.

At what number would you consider this to be more than "very little competition"?

After getting screwed around by my bank (ASB) I am looking to get away from them. Wise is tempting. They are not a bank.

My salary can go to them. Why would I need a bank for taxes or my children?

The only thing holding me back is the fact that money isn’t government guaranteed as secure with them. With ASB NZ$100k is government guaranteed.

It automatically moves all of your Direct Debits, recurring payments, balance etc. It even redirects incoming payments to your old account to your new one.

It other countries it is a lot less trivial.

The central design theme of GrapheneOS is to have stronger sandboxes and more limits on what apps can access than stock Android does. Granting an app root access does exactly the opposite; someone behaving rationally and consistently usually won't want to do both on the same device.

We wouldn't mind providing a 2nd set of releases with user root access but those would have separate signing keys for privacy and security reasons. It would not be accessible to large portions of the OS to apps. We don't do it because it would double the number of builds and would be a massive amount of additional work for managing and testing it. It would take immense resources to create a variant of the OS which we'd recommend against almost anyone using mainly to provide a novelty. We have much better uses for our resources. Resources are always limited and doubling the number of OS releases for a 2nd time would have a huge cost.

Few orgs understand compliance. While there might be some compliance people at the org level, individual teams implementing features will need to have a good line to them. In the end, knowledge is siloed and everyone needs to deliver on time. So it’s easier to forbid with some controlled collateral damage than to permit with an uncontrolled downside variance. Just a derisking hedge.

Serving use cases that drift away a bit “too far away” from the average (+ some sigmas) use case is not economically justified for a product manager - their KPIs would deteriorate from such “altruism”. No one will care if a few low-margin customers can’t use the product.

Most of the banks don't require not being months or years behind on bare minimum Android security patches let alone requiring anything close to proper security patches. That may rapidly change in the near future due to AI accelerated exploit development making exploits far more accessible and broadly deployed.

Nearly all these apps aren't banning GrapheneOS on purpose but rather because they're doing the least possible work to implement weak anti-tampering measures. Play Integrity device or strong integrity levels are an easy way to do it. They can use strong integrity if they're willing to forbid extraordinarily insecure devices failing to meet a very low bar for security. Most banks aren't willing to do that since it would mean blocking the majority of Android devices so they use device integrity which barely does anything more than enforcing licensing Google Mobile Services to reinforce Google's monopolies. Even the strong integrity level doesn't enforce much more than that, it's mostly just much harder to bypass at scale.

I'm surprised to see that in this thread. That's usually reserved for politics and arguments about AI.

The scope is much smaller than that: restriction on what banking conveniences are provided.

> Most of us understand the desire to protect customers from fraud > At some point, the cost of preventing additional fraud, including the loss of individual choice and autonomy, exceeds the benefit > Could we aim for proportionate

I think you have answered your own question here; if a less than single percentage of retail customers use something that's not a general iOS or Android device, anything beyond that is not really worth it until regulation says otherwise.

I can't think of a legitimate reason to check this and refuse to run in a secondary profile. But banking apps sure love to cargo-cult invasive nonsense.

A lot of people aren't able to distinguish "I got scammed" from "the bank took my money away".

Unless the bank has reason to believe that you're either trying to defraud the bank, or where unduly careless with your banking credentials (and you have to be really careless to meet that bar in the eyes of the regulator and the courts), then they're expected to refund you.

I've seen banks refund £100ks to customers that were defrauded over many months via romance scams. There are cases ruling by the Financial Ombudsman forcing banks to refund customers to handed over their cards and PINs to carers that then stole money.

The general attitude of the law in the UK, the regulators, and the courts, is basically it's the banks responsibility to provide appropriate security, in a form that their customers can easily use and understand. If banks want to make it easy for customers to move and spend money, then the risks associated with that convenience accrue with the bank, not their customers.

Obviously banks work very hard to worm their way out of their responsibilities here. But if you use the consumer protection tools that exist in the UK, which are very easy to access, and which your bank is required to inform you of, then it's surprisingly easy to force a bank to refund you for any fraud you suffer.

I haven’t looked for a one-app-to-rule-them-all, but in principle it’s possible.

I think the UK banking sector is in rude health. It’s very competitive and it’s easy to move. The quality of the apps is very much part of any competitive advantage.

I have accounts with four uk banks and it’s trivial to manage them. It’s an example of legislation working really well.

If someone lies to them and tells them there is an app that lets them get free Roblox bucks or whatever, but first they have to root their phone, they will. If someone lies or makes an app that removes pimples or adds makeup in realtime, or something, but they make it only work on rooted phones, they will.

And it’s a completely different demographic than those would would fall for the phone call scam, but it’s incredibly disingenuous of you to suggest that the only malware distribution vector is being tricked into installing an APK.

I know people who are interested in modding games, pirating software, and installing “cool” apps just for the novelty. I would argue the most likely reason those people installed malware is voluntarily, because they searched out a hacked version of Bloons Tower Defence. Not because they “needed to pay an outstanding Windows service bill”.

And there is a very large swath of banking customers who I wouldn't be surprised to learn that banks will earn less than $130 from over the course of a decade.

GrapheneOS is an open source project and people can make their own builds with arbitrary modifications. We recommend not adding a third party system giving root access to a large portion of the OS and making it possible to grant to apps with a dialog since it greatly reduces security if it isn't used. People can do what they want regardless of our recommendations.

Modifying GrapheneOS in any way creates a new OS which is no longer GrapheneOS itself. Forks of GrapheneOS must come up with their own name and branding if they're going to distribute their modifications. We don't want software which isn't GrapheneOS being confused with it.

Banks are increasingly adding checks for Google certified devices. In the EU, there are regulations requiring banks to start verifying device integrity. It's headed that way worldwide with a growing number of regulations and industry standards requiring it. Apple's App Attest API and Google's Play Integrity API have repeatedly been the only options recommended by the EU which has contributed to the worsening situation in the EU in particular. We convinced the EU to remove those specific examples from several official standards. No one has been able to convince them to stop heading down this path despite a lot of people pushing back against it. We haven't been able to convince them to define actual requirements let alone to require permitting anything which meets those requirements. They give a vague description of what they require doing shaped around the Apple and Google integrity APIs.

We convinced around a dozen banks mostly in the EU to use the standard Android key attestation API included in the Android Open Source Project as an alternative. It allows apps to verify the OS verified boot key hash, patch level, app signing key hash(es) and app version code based on a root of trust. This meets the requirements for the EU standards and enables permitting any alternative with verified boot and a mandatory app sandbox with support for verifying the app's signing key and passing it to the hardware keystores. Other operating systems can publish their signing keys in the signed JSON format we published and ask the same companies to include their keys too.

Once apps implement an alternative to the Play Integrity API to permit a single OS, it's easy for them to add more. The hardest part is getting them to even consider doing it. It's nearly impossible to get in contact with the right people and to convince them to do it. Once we establish that contact and convince them to ship it, it's a lot easier. There has been an ongoing issue of these apps not adding our new verified boot keys which are per-device-model for security reasons similarly to the Pixel OS. We tried to solve that by creating a standard signed JSON format which can be automatically retrieved and used to automatically include the new signing keys. Exactly the same approach can be used to delegate certification and inclusion of arbitrary operating systems to other organizations. It can also be used for handling which roots of trust for non-Google-certified hardware are also permitted.

We would prefer if none of this existed but we don't live in that world and we're doing what we can to convince apps to permit GrapheneOS and other alternatives. We're heavily fighting against it being done in the first place and against more standards and regulations requiring it. We're also fighting against more centralized attestation systems such as the Play Integrity API as opposed to systems with actual standards where anything meeting those standards can be included. It would not be a good thing for there to an EU alternative to the Play Integrity API permitting specific operating systems and devices based on geopolitics and business interests. That would only accelerate adoption of attestation by EU apps which is already happening at a faster pace than elsewhere thanks to both EU regulations and what many of the countries are doing themselves.

This ‘all or nothing’ attitude in the comments is a bit silly to be honest.

GrapheneOS and AOSP do use the userspace components developed with the Linux kernel such as iproute2. GNU components aren't part of Linux or the broader Linux project. Those don't even use a compatible license. It isn't legal to use the Linux kernel source code as a reference for writing glibc code since GPLv2-only does not permit the additional restrictions of GPLv3.

Linux is not an operating system unto itself, but rather a kernel—a core component that manages hardware resources. Android uses the Linux kernel, but replaces the traditional GNU userland with its own runtime, libraries, and system framework.

Many users run Linux-based systems every day without realizing it. Through a peculiar turn of events, the Linux kernel combined with Android’s userspace is often simply called “Android,” and many of its users are not aware that it is built on Linux at its core.

There really is Linux in Android, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine’s resources to the other programs you run. The kernel is an essential part of the system, but useless by itself; it can only function in the context of a complete operating system.

Android is normally used in combination with the Linux kernel: the whole system is basically Android/Linux, a Linux-based operating system with a distinct userspace, not a GNU/Linux system like traditional desktop distributions.

You get the roughly the same security properties by enrolling user-owned pubkeys.

Apps are not required to use the Play Integrity API or a similar attestation API. The details of what they're required to do are unspecified and open ended. Many are interpreting it as meaning they use the Play Integrity API and we have to convince each one to permit GrapheneOS via the Android attestation API. It's not good and we would greatly prefer if this wasn't happening even if we were managing to convince most apps to permit GrapheneOS.

Not only these features. Viewing PIN, enabling bank cards for internet purchases, enabling/disabling cards.

But they are explicitly changing their terms: https://discuss.grapheneos.org/d/17714-revolut-mobile-financ...

Potato, potato, right?

Is there such a thing as a non-stock operating system that is certified by Google?

This is excellent news, because the phone that has been confirmed so far (the Signature 27) is absurdly large and expensive. The Pixel 9 I currently run Graphene on is already too big for my taste.

I'm a previous Moto user and despite Pixel supposedly being more advanced, I really disliked them. I always preferred the Moto phones.

Gives me hope!