Posted by microtonal 8 hours ago
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
Even if they did, I feel the result will be the opposite of what you expect. EU own reference implementation of eID relies upon Play Integrity [0].
[0]: https://github.com/eu-digital-identity-wallet/eudi-app-andro...
That would solve the issue rather quickly.
Normies don't understand the that any computer should be able to run software from any other computer. They dont get the idea of the general purpose computer. They've bought into the idea of computers-as-appliances sold by steve jobs and others.
The executives you're talking about don't see an issue with this. Their solution for this is the same as everything else: spend more money and buy another device. User freedom does not even enter the equation.
If they identify as a normie or an appliance peddler who is offended by the tone suggesting computers "should" be general purpose?
Or they are offended by the implication that said normies are perhaps unable to understand this lost potential, rather than making principled choices to embrace the appliance shlock?
I believe the fit is so poor that google should really object to it. I already refuse to make youtube videos because I need my gmail account.[1] If I need my google account for my ID and my payments I cant use gmail.[2] I also don't need Google ads badly enough.
It doesn't take a lot of stupid to lose the account but ANY account activity at all may trigger false positives.
In theory the US government can seize EU google accounts. Given time I'm sure we can find even crazier rulers than Ursula and Donald combined.
[1] - I got one flag for a 10 min video including 10 sec of 1991 footage from a local NZ news agency credited both in the video and linked in the description.
[2] - I've already lost my account once temporarily for jokingly hitting reply-all without looking how many cc's there were.
"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.
There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.
Access to that kind of data requires regulation, a lot of it and that's why Third Party Providers exist. There are a lot of them in Europe and they're not expensive.
I actually didn't expect to find anything about bunq around here but I have to say they're the worst bank I've worked with. When we started working with them, their API were broken and the devs had no idea why. It seems to have improved recently but it's definitely not a bank to praise for their API.
And now we have a paypal-like shopping experience via SEPA Instant Payments, all our PayPal hating customers are happy ;)
I know, that's my point. It's a stupid decision.
> Access to that kind of data requires regulation
It's my data. I want to access it how I see fit.
> There are a lot of them in Europe and they're not expensive.
I already have a bank and I already pay them. I don't want to pay anyone else to be able to use my bank account in a way that suits me. Sadly, there aren't many good options.
Someone mentioned Wise, and they do seem pretty interesting. But it makes no sense why common high strees banks refuse to cater to power users, or even to users who aren't using mainstream devices.
It ain't your data, it's the bank's data about you. Banks are shitty about access, APIs because they are perpetually in CYA mode from KYC/AML rules from the US (also on most foreign banks) and GDPR and cousins in Europe.
I was actually surprised how many bank apps will work under GrapheneOS even if only partially.
"Power users" don't make them more money. In fact, from their POV, you're a legal, reputational, and security liability.
They often act as marketing and can find and report security vulnerabilities rather than the criminal element doing so first.
Balances are held in Wise at your own risk.
Seriously, count your blessings man. In America we only get Plaid, which only works right or reliably for big banks (which are also the worst ones), and it isn’t an API for humans, just a paid SaaS product that a company who wants to offer integration with banks has to pay (i assume a lot) for.
You mean the step from sandbox to production application, or you're not even getting access to the sandbox itself? I managed to get sandbox access with ease via two separate banks (both Spanish though), with no problems, think it took them one (working) day or something to review my "application". I never tried to get anything into the production environments though, but makes sense they'd be a bit tighter on that tbh.
Not sure why you'd claim it's impossible, it's in wide use already by banks, fintech and payment service providers across the union.
To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.
You dont actually give them money...you loan them money when you do a deposit. That is why they pay you interest, and that comes with the risk of loans to another party.
A little detail they are happy to omit and they are happy to let people talk about: "I have money in the bank", that you of course ...dont have.
There's no real risk involved.
As of June 2026, the FDIC had approximately $161 billion in its insurance fund against...drum roll... $10.8 trillion in insured deposits.
Good luck calling on your insurance on a systemic bank crisis....
A situation which calls that borrowing capability into question would mean the economy is so bad the dollar is worthless.
More if you're in Silicon Valley… semi-/s
Not really related to the discussion here though, since we were determining whether the interest rate is zero.
The bank still uses the deposit money in that system. You are right to point out those same people on the street I mentioned would freak out even more if they knew that banks essentially lend out more than we deposited and also that they might sell your debt and all that jazz (I bet most people either never understood what happened in 2008 or forgot already other than a vague "yeah mortgage crisis")
Absolutely true. They question here is how many announce they are borrowing from you :-)
That's what banks do. It's not a secret. Any cursory understanding of banking gives you that information.
Because courts have made them pay the curtomer their losses when the customer (not the bank) was scammed/hacked/etc.
Unfortunately, banks can be held liable for customers getting scammed. Even if they win in the end, they have to make the customer whole first no matter what [1].
[1] https://www.tagesschau.de/wirtschaft/verbraucher/eugh-konto-...
- max length of passwords (not talking about lengths that would pose a DoS threat, talking limits like 20 characters)
- incredibly constrained character set for passwords (“your password can’t contain a quotation mark, only alphanumeric and these specific 10 punctuation marks”)
- “security” questions (can we just ban these already? Knowing that my childhood dog’s name was Bingo should NOT give you the ability to change my brokerage password.)
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.
Did the higher ups want more effort to be spent on "security"? Yes. Is there any way to actually add "more security" to the setup? No. Could not doing anything in face of direct orders from the above be bad for your career? Yes. So random bullshit go.
It's not like the bank client developers are even implementing any of it themselves. They buy someone else's middleware and hopefully don't misconfigure it when they cram it into their builds.
The Fire Phone was a midrange Android phone from 2014 preloaded with Amazon's app store and services instead of Google's. It failed on its own merits, but I think Google got scared someone else would do a better job. The barrier to entry is a lot higher if most people can't use their banking app on it.
Do you really think banks care about you installing custom themes or whatever? They only care because the cracked Spotify app also has malware bundled on the side which uses the new root access to break the app sandboxes.
I also consider restrictions against open source to be malicious acts - hence also malware, such as by banks and other companies. Or, worse, government agencies. In a local medical university in central Europe, for instance, we are required to either have a Google account or a Microsoft account - usually the latter, to access emails.
All paid by the taxpayers ...
EU has PSD2 which enforce good, strong rules on customer authentication. For example, banks must have two-factor authentication. And if both factors live on the same phone, the bank has to safeguard against that phone being compromised. Hence the root detection and app-integrity checks that he is complaining about.
But what's tragic is that instead of understanding the problem, which is partly driven by regulation and mostly not even a problem, he calls for more government regulation. What a mess.
it would be if wasn't for the obvious reasons of those being banks
When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which always include all of the user hostile bullshit you mentioned.
It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/
The only way this can NOT happen is if someone quite senior signs off on the risk, who would have to get in a big fight with the cyber/policy teams for basically no benefit to themselves. They would also have to be unusually technical and pro freedom to even understand the issues, which is not the typical personality profile of the kind of executive who ends up with overall risk authority for a bank's mobile app.
I basically said it was bullshit, pointed out that this was not industry best practice, and that we weren't storing any sensitive information.
The meeting ended quickly (and it became clear that the auditors were full of hot air.)
- auditors which commonly "pass" things which should be flagged, but happen to be a more expensive then normal industry standard in ways which should make them non-competive but somehow they get hired a lot
- auditors which flag nonsense and don't understand anything about security at all
some of the "security frameworks" which are applied by default makes a lot assumptions about how software is build/structured/works _based on what was common in the 90th_, and they don't even list their own assumptions... Luckily they are a base line you can perfectly fulfill but still a pain.
Like e.g. a session key having 128bit entropy is a reasonable minimum, but then imagine the framework assumes the session key & session id are the same because some 90th software did so and now requires you session ids to have 128bit entropy, but e.g. UUIDv4 has only 122bit entropy and a UUID being used is deeply integrated into middle-ware you use and can't be changed... (And having a session id=session key setup is anyway a bad idea as it means you mustn't log the session id anymore, but you also might have requirements which do require logging session ids in audit logs and similar).
This isn't even the most nonsensical thing I had ran into, just one I remember well. There where rules based on assumptions of you uploading files into a file system _using the upload file name_ while interleaving security sensitive web-server config files with uploaded directories ... like yes I know some software did so in the past but the rule should be "your software musn't do such a negligent thing" and not "you software must do this 5 extra steps in case it maybe does that insane negligent thing"
I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).
you assume this exists / can exist
(for a given set of reasonable requirements which aren't yours)
but various "practices" and "regulations" for software security push banks into the direction of such nonsense, so if a major reasons this is happening is the government asking them to fix it is very reasonable
similar in other context where that argument is often used you have problems like monopolies, collusive agreements or various source pushing companies into acting collectively user hostile weather it's laws or other reasons
the government fixing such things by changing laws/regulations is pretty much the only things which can work in many cases
this doesn't mean they have to tell companies exactly what to do, instead they (should) find out what pushes things in bad directions and then "counter balance it" in some form or way
Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.
Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.
> forces banks to provide access through a common API standard
Doesn't PSD2 already provide this?
Eg the above example; how is it possible to send money without knowing who the other side is? I can trivially look up a domain name and see registration info, I can look up the IP to see who it’s registered to, I can check certs to see if they’re valid and legit.
It’s bizarre how normal we think it is to send large sums to random strings of digits that we think are Amazon or the IRS with basically 0 way to validate them.
I bought a house in cash and putting the money in escrow was unbelievably stressful. They send me numbers, on a printout that’s a scan of a scan of a scan with text that says “call to make sure this is still the right account number”, and a bajillion warnings to make sure the number is right or vague and terrible things might happen.
Insanity that I can get insanely complicated gadgets shipped to my house in 4 hours but we don’t have a better way to move 6 figure sums than “double check your numbers”.
This reads like you’ve never made a large purchase outside of the internet. I don’t know why you’d advocate for this except to be contrarian.
It was nice to be able to spend $30k+ on short notice. With modern security features, there is no need to enforce an arbitrary time limit if the payer accepts the risks.
Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
You mean like HTTPS? It's a shame that mobile banking website have fallen out of favor.
To provide me with API access to my own accounts, Era goes through another third party provider which again connects to my bank. I guess they could eventually get direct connections themselves.
So instead of me get convenient read-only access to my bank, I've ended up giving two separate third party providers credentials I'd prefer they didn't have.
All I'd need was an automated way to get a CSV or JSON dump of my transactions and I'd have been happy, but none of my banks support that without manually logging in. It's infuriating.
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
But that is quite limited.
You need to have a bank account to live a life outside the woods.
I have multiple bank accounts, because I am a solopreneur, yet all of them are weird in their own ways
I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.
It's a very difficult set of choices.
Banks on the other hand, as much as hateable (most of them are), also just shit bricks at mere thought of one regulatory spanking, not only hammering from their boards and shareholders (esp. the major ones). So – it might be a great idea to not shit on banks shitting on such choices.
Banks are also sacred of making changes and going farther from the "mainstream" and another reason is also because - they handle "real money", often people's entire life-savings.
We just think:
… oh, this OS is soo cool, so safe, let's use this.
… And then notice: goodness, this motherfucking company is not letting me use their app on this coolest and safest shit out there. Burn them!
And banks think:
… shit this one is not part of any common industry standards, let's stay the fuck away from it.
… Further: ha, authorities don't look kindly on this OS, let's stay extra away from it.
… And more: will this mean we have to support one more standard, one more release channel, one more modified OS? Anyone who mentions name of this OS again will thrown out of the window of highest floor of our HQ (and mind it, we are on 33rd already).
Solution (one of the) is forcing Googles and Apples to stay open, to stay respectful of user privacy in an absolute and transparent manner, to not let them implement closed-off protocols, to have APIs that is not availalbe to everyone – in a safe manner, not let them (and the politicians and security agencies) fear-monger the public like "think of the children" etc. Blaming banks is literally barking up the wrong tree – esp. in this context.
Another way is: not buying these devices and suffer the pain (and experience the bliss, yes!) and then hope/work for this number to increase and collectively point a thick and long shimmering hot rod (metamorphically speaking) at the hinds of such companies (hell, include the banks as well – so that they won't fuck up their desktop and mobile portals) so that they collectively feel the heat and are forced to bend (no metaphors here!). But no, we won't let go of our annual pleasure of this practically bullshit <First Time on an X>™ orgasms.
tl;dr: SafetyNet was not a mistake, making something like SafetyNet into the monster it and then making it limited to one company/one publisher (esp. since they are the ones who also control the OS) was the mistake. I think of this to be solveable sometnhing on the lines of multiple certificate issuers (but we have to be careful of eMudhras) - both for safetynets, and app stores (if not combined).
> will this mean we have to support one more standard, one more release channel, one more modified OS?
Android apps don't have to take any active steps to support third-party distributions. All they have to do is refrain from taking active stops to block them, but I suspect you knew that.
[0] https://www.nytimes.com/2003/06/30/business/technology-a-saf...
Wow, where'd you find a bank with a mobile app that lean? Please share for everybody's benefit! /s
Half a gigabyte of app bundles is unfortunately no longer an outlier...
An immutable OS install and app sandboxing by default provide a lot of security. Those are present on third-party Android distributions that don't pass SafetyNet. Some users of those add root access so they can let a handful of apps out of the sandbox, but I'm willing to bet most of those are tech experts with better security habits than the average person.
Show me examples of actual data breaches and account takeovers SafetyNet would have stopped if you really want to defend this position.
It's just a way for app makers to point their finger at someone else.
No, Play Integrity labels those old systems as secure, _even though they are not secure_ due to lacking years of security patches.
Play Integrity does not prove that something is _secure_, only that the OS that is running _was approved by the phone maker_.
This is the crux of your entire argument, so you kind of need to actually substantiate it. Does Play Integrity catch an app from to Play Store using an exploit against a comically ancient vendor kernel to do anything it wants? How?
I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Most European banks either don't have a web banking at all, or require a mobile app to log into it. There are exceptions but they are rare and becoming even rarer.
Not all banks. Monzo doesn't have banking through the website, and I doubt they're the only ones.
Maybe not for you, but you don't know his bank. Obviously I can't pay with my phone if I sit at my computer and use online banking in browser, so obviously payment with phone app won't work if I use browser on phone, for all other online banking functionality there is no benefit in the app, all of my 3 banks I regularly use don't require any card reader or even smartphone, all I need is any phone being able to receive SMS with 2FA codes, if my bank required app to use online banking I would just stop using their services. I am not going to bother with app in the phone while sitting at computer with 32" display and proper keyboard.
There are app only banks, you make your choice and you pay your price.
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess? Not how I'd architect it...
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
[0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe...
[1] https://walt.is/
Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.
Now, that isn't to say there aren't security issues, nor that QA is perfect on devices they do support (like with any enterprise software projects), but it is a valid reason from a business perspective to not support everything.
Why do you think generally OpenBSD and such platforms aren't supported by commercial software, nor most open-source software? It adds a lot of burden for testing and QA on developers who will need to become intricately familiar with yet another platform.
People stare blindly at some customer support answers and hinge everything on those words, but if you think carefully about how software, compatibility and support work, this all makes perfect sense.
Hardly true, if they permitted Lineage and so on.
> Just like any enterprise software, it targets a set of common devices so they can provide support and QA on it.
Not really, there are a myriad of devices and they're not testing on all of them. A "pound sand if you're on an unsupported device and it isn't working" policy would be perfectly acceptable, as long as the issue isn't directly caused by the developer purposefully breaking the application for a subset of users that fail Play Protect check or whatever.
GrapheneOS have written about (in)security of LineageOS:
https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
I agree, but that is also totally unrealistic for normal people.
Btw, My son has a 200 eur Samsung Galaxy A26, very fine device for the price I have to say, and supported until feb 2031.
Installing Lineage isn't that hard. If they're going to badly inconvenience some customers / force hardware purchases, why not start with the ones who are most likely to get their accounts drained?
I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the US and YOU are throwing YOUR privacy conscious users under the bus, because you do not fully understand the forces at play.
Idk, this can be much improved :)
The bank doesn't care about either. It cares about the risks, costs and opinion of the regulator on how well it evaluates and controls those risks.
If risks can be transferred to an external party and DNB signs on it, sure. If DNB says reliance on this specific external party is a risk in itself, then sure, there will be a plan for that too. The plan could be "if google becomes a problem we can publish a new version of the app using grapheneos attestation anchors in N weeks"
Or are you saying the device is insecure BUT has no local privilege escalations you can take advantage of as a user?
No they don't. At best, they do a cost-effective proxy for what should be done.
Even though the banks' policies are driven by incident responses and real data, whereas your position is presented on theory.
Why do we trust soulless orgs? Trust this dude who puts his own face on his product!
I have ING app installed on the tablet, the only issues the bank has with it is I get more notifications wanting me to do online training on cyber security or being scammed. I get the same notification every few weeks that my device is rooted and it is "potentially more vulnerable", I can click "I understand" or "Learn more". No other issues, it's not blocking me from doing anything, not forcing any updates, doesn't limit any functionality of the app. Despite my salary is not paid to ING, ING is my main bank. Monzo UK didn't allow me to run on LinageOS on a tablet, Revolut isn't available on tablets at all.
Supposedly the Dutch police had "cracked" their phones.
In Dutch https://archive.is/3wawb
According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.
His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.
https://www.joint-defense-team.com/post/grapheneos-cracked-p...
> Insider attack resistance for updates to the secure element (Owner user authentication required before updates are accepted)
From my understanding, this means that even if you do have the signing keys, you cannot install an update that would remove the need for knowing the screen lock to unlock the filesystem's encryption - as installing such an update requires entering the screen lock first.
social media was designed to appear like it is society, endorsed by the same people who _made_ the society
i think its all just an illusion to make us work harder :(
This is so braindead, it’s the same as “a black person committed a crime, lets search all black people!”
If someone with an iPhone commits a crime, will they do the same?
And it is not "braindead". EncroChat was a "privacy service", selling phones featuring E2E encryption, disabled cameras and microphones, etc... Even though it wasn't marketed as such, it was mostly a service for criminals. And they effectively searched everyone using these devices (they hacked the firmware), and maybe a few people who weren't criminals got searched, as it happens in many investigations, most people turned out to be. The result was many arrests of people you really want to get arrested, with weapons, murder, torture, etc... being involved.
That's also the reason why mainstream apps like Signal are important for privacy, if only criminals use an app, having that app is a legitimate reason for being suspected. If most people using the app don't really need privacy and it is mostly used to talk about what to eat for dinner, that protects those who really need that privacy. And yes, it includes criminals, unfortunately, so it is actually a good thing for society when criminals use their own communication channels instead of using mainstream ones, good thing most of them are not so smart.
So Peter de Vries is effectively the dutch equivalent of John Smith.
iPhones and Apple systems in general are the most locked-down phones on the mainstream market, so very government-friendly in that sense.
It's why I'm always slightly disappointed to see developers using Apple systems. They're a far cry from the systems that Steve Wozniak originally built.
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
source: https://www.heise.de/en/news/Sovereign-payment-service-Wero-...
My mortgage was with a bank that had a website but no app and I was happy, and then they merged with another bank and only had an app and no website and I was not at all happy (but the bank they merged with also had their own mortgage product with both app and website and I do not know why they didn't migrate to using that platform). I swiftly moved to a bank that incidentally had a lower interest and both a competent app and website, and I noted to the previous merged bank that the reason I was leaving is that they did not accommodate me. Whether that feedback was heard, I'm unsure.
Hopping banks is easy for just savings, but a lot of work and inconvenience for your standard payment accounts, and that's ignoring additional services like mortgages and insurance.
The solution is not voting with your wallet, but either leveraging the DMA or drafting new laws that counter this.
Either Google should be forced to approve secure alternatives like GrapheneOS or companies should be required to also implement AOSP attestation. Or alternatively, remote attestation should be banned completely, but I can understand the argument that it serves some legitimate uses.
Vote with your vote for politicians for common sense regulations that favor the consumer at the expense of everything else.
[1]: https://www.acm.nl/en/publications/acm-savings-rates-lag-beh...
0: https://www.rabobank.nl/particulieren/beleggen/rabo-beheerd-...
It is also just very hard in practice. A lot of people have their mortgages, savings that are locked for years, etc. at a bank. Also, switching a bank also impacts other family members if you have shared accounts, etc.
In this particular case it's also not fully clear yet whether Wero is starting to enforce this. If that happens to be the case, it's only a matter of time before other banks also start requiring Play Integrity for Wero transactions.
That's not good enough, you also need to convince regular people to do the same. Your vote alone will not achieve anything.
I've completed my transfer this year. I am waiting a few more months to close my Dutch bank account (with the parent company of ASN). Good riddance.
It most likely won't, because people want the security that cards offer when they order online. Wero could be good or even great for other things, but not for making online purchases from another country.
What Wero will do, is allow a German citizen to order stuff in a German shop, and an Italian citizen to order stuff in an Italian shop first and foremost. After that, it will allow them to pay for stuff on Vinted (people already buy second hand clothes across borders this way!) or Steam.
It will also make buying stuff in different European countries easier, but that is only a tiny percentage. The winners here are citizens being able to shop around further, and shops with dedicated national versions of their store to sell stuff easily to citizens in whichever country they decide to port their shop to (in addition to simply serving those who are fine with their shop in English or another language).
If you only know credit cards, you won't see the benefit, but Europe is predominantly a place of debit cards and local payment methods.
No, it is not troubling, it is realistic for a service with high expectations and reliability expected, on tight schedules/resources
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
I get banning rooted devices and unlocked bootloader (despite I disagree of them being ground for banning), but GrapheneOS left no possible excuse to anyone.
And by behaving badly I mean using a client other than the one they expect to talk with their server.
Imagine if there was just one banking app, and whichever bank it talked to was just a setting, sort of like how pidgin and trillian worked with chat back in the day. That would make the banks feel small. You can't have control over your device because it might hurt their feelings.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.
Anyone who has been around in the free-phone community in the last decade-plus would recognize such idealism as mistaken and never once borne out in practice.