Hacker News

> if a major regulator like EU steps in

Even if they did, I feel the result will be the opposite of what you expect. EU own reference implementation of eID relies upon Play Integrity [0].

[0]: https://github.com/eu-digital-identity-wallet/eudi-app-andro...

> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.

"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.

There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.

> But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".

> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.

Why would banks be motivated to care? People just give them money as a business model. Up until recently, Wells Fargo didnt have case sensitive passwords even, because no pressure to do anything about that.

To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.

The issue is weird. Banking is both conservative and on the lookout for new way to make things complicated, but one dumb executive --usually-- can't derail the entire bank, because there are enough stops in place. This is one of the reasons US banking is such a ridiculous mix of various integrations of a line of executive decisions resulting indirectly from lunches with said executives.

It wansn't a mistake, it was a deliberate attack on the user, i.e. malware.

Mostly the government forces them to do this. If the capability did not exist it wouldn't be mandated or used. Think about this whenever someone tells you "just don't use it if you don't like it", about everything.

I don't know if there is a common API standard from a technical point of view, but there is the legal framework for it. Banks in the the EU have to provide an access to third parties who provide account information services to clients (themselves being regulated and supervised by a national agency). I would assume because it is mandatory, it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.

> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which always include all of the user hostile bullshit you mentioned.

It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/

The only way this can NOT happen is if someone quite senior signs off on the risk, who would have to get in a big fight with the cyber/policy teams for basically no benefit to themselves. They would also have to be unusually technical and pro freedom to even understand the issues, which is not the typical personality profile of the kind of executive who ends up with overall risk authority for a bank's mobile app.

Instead of asking the government to fit all banks' products to your preferences, you could just use a bank that fits your preferences.

I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).

> banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it"

Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.

Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.

> forces banks to provide access through a common API standard

Doesn't PSD2 already provide this?

> By now

Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.

As Dunning said and Marx quoted:

> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."

I'd really love to see your banking app that works differently and cannot super trivially be attacked by malicious software. Can you show us your example of such an app? It might be helpful to show tha validity of your arguments.

Sounds like Open banking

The worst part is: you can't escape them.

You need to have a bank account to live a life outside the woods.

I have multiple bank accounts, because I am a solopreneur, yet all of them are weird in their own ways

I saw my bank embedding a keylogger and it was even scrapping the password entered to login and basically slurping everything done on the page to an external domain. I checked with the bank and they said these were their analytics and nothing to worry...

I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.

People need to stop calling for the EU "to step in", they already have and made everything worse. They forced PSD2 with """"""""""""""Open Banking""""""""""""""" which requires convoluted requirements and is regulated to death so no private person can call the API themselves and get e.g. their balance or transactions.

the alternative is letting binance give your money to north koreans.

It's a very difficult set of choices.

Much better - enforce that every bank that has app has a website and feature parity between both.

And that common API would require safety net too. Banks and the government are the same thing: the enemy of of free computing.

SafetyNet indeed was and it was not a mistake. Mistakes are bugs, a company doing things they didn't want to do, or didn't intend to have the effect it later had.

Banks on the other hand, as much as hateable (most of them are), also just shit bricks at mere thought of one regulatory spanking, not only hammering from their boards and shareholders (esp. the major ones). So – it might be a great idea to not shit on banks shitting on such choices.

Banks are also sacred of making changes and going farther from the "mainstream" and another reason is also because - they handle "real money", often people's entire life-savings.

We just think:

… oh, this OS is soo cool, so safe, let's use this.

… And then notice: goodness, this motherfucking company is not letting me use their app on this coolest and safest shit out there. Burn them!

And banks think:

… shit this one is not part of any common industry standards, let's stay the fuck away from it.

… Further: ha, authorities don't look kindly on this OS, let's stay extra away from it.

… And more: will this mean we have to support one more standard, one more release channel, one more modified OS? Anyone who mentions name of this OS again will thrown out of the window of highest floor of our HQ (and mind it, we are on 33rd already).

Solution (one of the) is forcing Googles and Apples to stay open, to stay respectful of user privacy in an absolute and transparent manner, to not let them implement closed-off protocols, to have APIs that is not availalbe to everyone – in a safe manner, not let them (and the politicians and security agencies) fear-monger the public like "think of the children" etc. Blaming banks is literally barking up the wrong tree – esp. in this context.

Another way is: not buying these devices and suffer the pain (and experience the bliss, yes!) and then hope/work for this number to increase and collectively point a thick and long shimmering hot rod (metamorphically speaking) at the hinds of such companies (hell, include the banks as well – so that they won't fuck up their desktop and mobile portals) so that they collectively feel the heat and are forced to bend (no metaphors here!). But no, we won't let go of our annual pleasure of this practically bullshit <First Time on an X>™ orgasms.

tl;dr: SafetyNet was not a mistake, making something like SafetyNet into the monster it and then making it limited to one company/one publisher (esp. since they are the ones who also control the OS) was the mistake. I think of this to be solveable sometnhing on the lines of multiple certificate issuers (but we have to be careful of eMudhras) - both for safetynets, and app stores (if not combined).

Nah SafetyNet offloaded a huge chunk of security on Android from app makers to Google/AOSP, it's an excellent system that works great for 99.99% of uses. It's what allows safe and fast banking on Android in general.

EU wants to have as much surveillance as possible, that's their only interest.

> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.

> The Rabobank app works fine on Android phones that haven't seen updates in years...

Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.

Walt looks great. Though I'm not sure I'd trust my financials to a service that posts "Launch dat shit" as a milestone in their roadmap on their homepage.

In all fairness, you can’t normally do shit in the ING app without them warning you that you might be getting scammed, even on modern devices

You fell for really shoddy reporting by AD/HLN:

According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.

His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.

https://www.joint-defense-team.com/post/grapheneos-cracked-p...

This is the issue with being lenient on crime but also being liberal. You have to search for the "right" patterns to find your criminal. It happens that folks who care about privacy, and criminals, two distinct groups search and use the same set of technologies: wether it's grapheneOS, or others. I am also tired of people still looking suspicious at me for not having instagram, snap or tiktok or use whatsapp, it's like I dropped out of society, and that I use linux and use open source email clients/server, I use ublock origin advanced with blocking of scripts and 3rd party domains. Why privacy is an uphill daily battle.

> Police were looking for […] Google Pixel phones. These have become popular among criminals in recent years […]. Among others, the murderers of Dutch crime reporter Peter R. de Vries had Google Pixel devices with them during the attack.

This is so braindead, it’s the same as “a black person committed a crime, lets search all black people!”

If someone with an iPhone commits a crime, will they do the same?

I thought that one of the goals of Wero was to become less dependent on US technology (Paypal). By requiring you to use either Android or iOS it seems to me as if that is more of a marketing ploy than anything else. As multiple other banks that support Wero however run on non-Google Android I think it is more likely that whoever wrote that message just doesn't know what they are talking about.

Just how it goes, vote with your wallet.

My mortgage was with a bank that had a website but no app and I was happy, and then they merged with another bank and only had an app and no website and I was not at all happy (but the bank they merged with also had their own mortgage product with both app and website and I do not know why they didn't migrate to using that platform). I swiftly moved to a bank that incidentally had a lower interest and both a competent app and website, and I noted to the previous merged bank that the reason I was leaving is that they did not accommodate me. Whether that feedback was heard, I'm unsure.

The good news is: no need to stick to expensive and crappy Dutch banks. Plenty of foreign options.

I've completed my transfer this year. I am waiting a few more months to close my Dutch bank account (with the parent company of ASN). Good riddance.

> is troubling

No, it is not troubling, it is realistic for a service with high expectations and reliability expected, on tight schedules/resources

Wero is a standard that is implemented by each bank. The requirement can come from Wero, to be implemented technically by your bank.

Just the fact the method is namespaced under nl.devolksbank doesn't have to mean anything. Could just be vendored code.

Migration from ideal to wero was a change of a logo.

Just a heads-up from a fellow Pixel 6 owner: it has reached end-of-life last month, because the five years since the launch in October 2021 are up. Better start looking for a replacement soon.

How is GrapheneOS a bigger risk than a stock Android missing 3y of security updates?

Given that all these banks happily accept the latter, we can conclude that they do not actually perceive any of this as a real risk. Ergo, something else is going on (eg incompetence)

An OS available either for one Google product line or for a phone costing over 1000€ from Motorola, will never reach usage numbers high enough to change corporate policy on business grounds. (It may happen some executive within the company is just sympathetic to libre software even where there are no business pressures, but that's a long shot.)

Anyone who has been around in the free-phone community in the last decade-plus would recognize such idealism as mistaken and never once borne out in practice.

Isn't Motorola releasing phones with GrapheneOS next year? It should vastly increase the number of users.

Most of them require 2FA using their apps

Things like iDeal (wero) require you to use a banking app for most online purchases

Yes you can still use cheques, credit cards, use ATM to get money and see statements. Many still allow phone banking.

You can go to your branch to do many things as well. (OK fewer people do that so there are fewer branches).

Those would be most banks with physical offices.

They have a reason. It's difficult to support while maintaining the security standards they want.

What should be illegal is wanting to make every niche pet peeve of yours illegal

Yeah for now I use bunq + CurvePay for tap to pay (since Google Pay also doesn't work on Graphene).

Let's see how long they let me keep it.

I can't take bunq seriously because every time I approve a direct debit I keep seeing two transactions in the log -- one already processed and another still pending and also asking me to enter the pin again after it was approved.

Peak clown computing.

GrapheneOS does have their own device attestation sdk

Imagine the outcry. That would go against everything OS stands for, wouldn't it?

Wero is an initiative introduced by the banks, not by the EU government. They specifically lobbied to make the "digital euro" initiative much worse so that it doesn't compete with Wero. So it makes sense that Wero has the interests of the banks in mind.

I have noticed zero change in using iDeal / Wero since the rebrand.

The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can't be mitmed when the system trust store is manipulated

The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.

I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem

I thought the take money out of someones account was just an issue in USA.

UK definitely and I thought EEC banks use a different system that stops that.

“Needed a bailout” is putting it mildly. ASN bank is 100% owned by the state since the got in trouble (like 90% of other Dutch banks).

There are two different Safetynet check levels. One (BasicIntegrity) is easily spoofable, bug GrapheneOS already passes that. The other requires Google certification.

Not possible, you have to run a OS signed by Google.

Kinda exists already in the Netherlands: https://www.overstapservice.nl/deelnemende-banken/ .

There might not be any alternative because it would cost too much money to develop and more importantly to distribute it.

https://grapheneos.org/articles/attestation-compatibility-gu...

If Wero (assuming it's Wero) can push banks to implement Play Integrity, they can also make some guidelines or make a small SDK to for AOSP remote attestation. It's not terribly hard to implement and some banks already do.

I don't think there is an actual written regulation that talks about attestation or SafetyNet.

I can imagine in some meeting with the ministry or an industry association that somebody in charge said "implement all safety measures that Google and Apple provide, no excuses" and they just execute it.

I could also imagine there is a real need to do so. Maybe somebody found that criminals use rooted phones to robotically launder money or something like that. Or there was a criminal case where someone got a bank account with a fake ID and used it on a burner phone. Then the developers get a discrete notice from law enforcement or regulatory bodies and are told to close that gap. Who knows?

N26 works fine on GrapheneOS for me.... but I see there's a note saying:

> This app has started using Play Integrity to block new signups, existing accounts continue to work fine for now.

https://privsec.dev/posts/android/banking-applications-compa...

Fwiw, also for me N26 works, have had the account for years now, but installed the app a couple of weeks ago (when I got my Pixel 10 with GOS.)

Maybe during registration, but not during use.

They don't block Graphene directly, they block any phone that doesn't have attestation, which the Graphene phone cannot have. https://grapheneos.org/usage#banking-apps

Basically, GrapheneOS on a phone counts as a "tampered" device.

Probably in-person at a branch. However they are allowed to use technology for certain tasks; their elders just have to discuss (and vote?) on it first.

Answer: however we did it before.

Also the Amish are American and the American banking system is a very different (uglier) beast when we are talking about digitization when compared to the Dutch.

Unfortunately Triodos has strong ties to the anthroposophy cult

https://steinermentary.com/steinerlens/triodos.html

Nah. Unified Attestation is an initiative by some some companies that really have terrible security (years old kernels, drivers, firmware, often way behind on Android updates). They are also known for campaigns against GrapheneOS, including astroturfing. They also do a fair amount of eurowashing (in particular Volla, who sell UAE/Chinese phones as a European phone with a markup of hundreds of Euros).

If Unified Attestation would become a standard, they would use it to entrench themselves over GrapheneOS et al.

AOSP has an API for remote attestation attestation. Banks should just come up with a list of signing keys to be trusted. Heck, they can start here:

https://grapheneos.org/attestation.json

The EU banks are mandating that all their systems be backdoored by Google.

Trump has started forcing US companies to deplatform people in Europe that he does not like. This is not a legitimate anti-fraud step.

Certainly not true for ABN AMRO, see "Unable to open an account using the app?". Sounds like someone will come by your house to check your ID.

https://www.abnamro.nl/en/personal/payments/open-an-account/...

Incidentally I was happy to see that while they're phasing out their previous cryptographic identification device (that you put your bank card in) they will still support some kind of cryptographic usb dongle (in addition to smartphones).

Not quite true. All banks really want you to use their app, and the neobanks actually demand it (and get away with it because they are not as important as the so-called system banks).

But look at the pages more carefully, and you'll note that there is a way to open an account using just a web browser too (e.g., look at abnamro.nl). The links are deemphasised by using dark UI patterns of course.

ING is being really dirty about this. It should be possible to open an account, and get the OTP hardware device that reads the chip on the debit card, but they don't document how you can open an account without the app. It's probably possible, as existing customers can bank without the app, but you will probably have to call them.

Banks would love to get rid of all those nasty people without approved smartphones, but that would cause political pushback.

Thats simply not true. If I want to open an account I can go to a Rabobank office and open an account. There are still plenty of Rabobank offices around. I can also access all features (even pay with Wero / iDeal) via my Rabobank scanner on my desktop via their website.

> All other banks only allow you to open an account via their app.

TIL all Dutch banks (except ASN) closed all their branches and you can't register new account in the branch, what a progressive society it must be...