Posted by microtonal 9 hours ago
Feels like we have enough motivated and skill people to do and maintain that.
https://github.com/PrivSec-dev/banking-apps-compat-report
https://privsec.dev/posts/android/banking-applications-compa...
You can go to your branch to do many things as well. (OK fewer people do that so there are fewer branches).
Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.
Let's see how long they let me keep it.
Peak clown computing.
Leaving your phone unlocked basically meant someone could drain your account.
I reported it, zero response. Bunq, not even once.
One one hand with all the fraud and identity scams I know they have a difficult job. But, on the other, they also rely on sending me txts to login-no proper 2fa like TOTP security codes.
But this authority could be a bunch of cool people like Letsencrypt, instead of only Google.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
The situation changes every couple of months, can't figure out if they unbroke it already.
In the end this whole "buyer protection with percentage fee" is about the banks thinking: "We don't want to be a dumb digital sock for people's money. We have to provide value to them". But I want my bank to be a dumb digital sock to put my money in, nothing more. I'm really getting fat-up with all these MBA-types's thinking their company "needs to have a relation with me and add value". I mean I get emails from my utilities trying to get to know me. Seriously? I don't give a wooden nickle about my drinking water supplier. I just want to pay them and use their services and other than that I want to think about them as little as possible.
[1] https://www.accountant.nl/nieuws/2026/10/betaalbedrijf-molli...
Wero is a mess.
The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.
I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem