Dutch "idealist" bank ASN blocks GrapheneOS users from its app
Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS
ASN Bank, a Dutch bank that markets itself as ethical, now blocks non-Google Android builds, including GrapheneOS, from logging in. Users report the app fails without Google Play Services, and ASN told one customer that GrapheneOS is unsupported for Wero due to "certain security requirements." Meanwhile bunq set up Wero on GrapheneOS with no extra checks, and EPI, the company behind Wero, says it is looking into the complaints.
Feels like ASN just used the opportunity to start use play integrity without any second guessing.
- ACCount39
SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
- teekert
My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years...
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess? Not how I'd architect it...
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
[0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe...
[1] https://walt.is/
- agilob
I'd like to use this moment to praise ING. I have an old tablet running quite modern LinageOS. The ROM is rooted and I use apps that require root accounts. Its almsot only purpose is banking. I don't have banking apps on my main phone.
I have ING app installed on the tablet, the only issues the bank has with it is I get more notifications wanting me to do online training on cyber security or being scammed. I get the same notification every few weeks that my device is rooted and it is "potentially more vulnerable", I can click "I understand" or "Learn more". No other issues, it's not blocking me from doing anything, not forcing any updates, doesn't limit any functionality of the app. Despite my salary is not paid to ING, ING is my main bank. Monzo UK didn't allow me to run on LinageOS on a tablet, Revolut isn't available on tablets at all.
- stef25
In Holland, GrapheneOS users are being targeted by police after "busting" a re-seller. The owners of the phones got raided without them being involved in any investigation. Just having the phone was enough to get a knock.
Supposedly the Dutch police had "cracked" their phones.
In Dutch
- Freak_NL
The response from EPI/Wero in that thread is troubling:
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
- microtonal
Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
- dethos
This is a result of the duopoly. You abdicate too much responsibility to the platform because it is easier for you. It ends up in a spiral of more lock-in to the platform and more power to its owners.
We need at least a third option [1].
- yowo
Always install these apps and negatively review them, specifically mention banning of GrapheneOS, there is absolutely no plausible reason for that.
I get banning rooted devices and unlocked bootloader (despite I disagree of them being ground for banning), but GrapheneOS left no possible excuse to anyone.
- croniev
I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
- Aozora7
My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits.
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.