zlacker

[parent] [thread] 28 comments
1. petral+(OP)[view] [source] 2025-08-25 21:50:19
How do you access banking and other sensitive apps? If the answer is, you don't, well, you can see how that's a non starter for the vast majority of people.
replies(10): >>miloig+E2 >>seanw4+a3 >>ethagn+64 >>VLM+05 >>bogwog+d5 >>GeoAtr+08 >>anticr+r9 >>Pxtl+Ki >>kelnos+ro >>beefnu+3p
2. miloig+E2[view] [source] 2025-08-25 22:03:07
>>petral+(OP)
My banking app works fine on GrapheneOS. There is a crowd-sourced list here with current status for many of them: https://privsec.dev/posts/android/banking-applications-compa...
replies(1): >>kelnos+Po
3. seanw4+a3[view] [source] 2025-08-25 22:05:53
>>petral+(OP)
A web browser in the worst case scenario. The same way you'd do it on a computer.
replies(1): >>debaze+u6
4. ethagn+64[view] [source] 2025-08-25 22:12:12
>>petral+(OP)
What's wrong with their web apps? The only real shortcoming I can think of is depositing checks digitally but I haven't had to do that in years.
replies(1): >>kelnos+0p
5. VLM+05[view] [source] 2025-08-25 22:17:43
>>petral+(OP)
My credit union app already wants 24x7 GPS tracking of my location and full access to my camera at all times and full access to my collection of photos, so the app is already dead to me anyway. Demanding that I use it on a locked down device isn't going to change anything for me, I'm already actively not using it. I use the website on a desktop, I rarely need to access my CU at all much less access it remotely. Given the large amount of battery and bandwidth already used to track my every move, I wish there was something like "Docker for phones" where I could enable and disable 24x7 full access to my every action IRL.
replies(1): >>platev+gx
6. bogwog+d5[view] [source] 2025-08-25 22:18:36
>>petral+(OP)
As a GrapheneOS user, the way I access my banking app is by downloading it from the Google Play store just like everyone else.
replies(1): >>rcxdud+cc
◧◩
7. debaze+u6[view] [source] [discussion] 2025-08-25 22:25:40
>>seanw4+a3
This is quickly disappearing as an option as well. I need my bank app to authenticate even when using a web browser on desktop. Luckily my banks app still works on GrapheneOS, but I suspect it's only a matter of time before they disable that because of "security" reasons.
replies(2): >>Pxtl+7j >>markas+Qj
8. GeoAtr+08[view] [source] 2025-08-25 22:34:59
>>petral+(OP)
Second phone for all official business apps, banking, etc. Never leaves home and it's used only for this purpose
replies(2): >>jiggun+uk >>lan321+AP1
9. anticr+r9[view] [source] 2025-08-25 22:44:46
>>petral+(OP)
Most banking app work, either directly or with a settings change to allow Google Play Service emulation. [1]

[1] https://grapheneos.org/usage#banking-apps

◧◩
10. rcxdud+cc[view] [source] [discussion] 2025-08-25 23:04:08
>>bogwog+d5
They don't all work, though: too many crank up the settings on google's various 'integrity' checks and will fail on anything that isn't 100% google-blessed. (Which is insane, because that's all that's required: on a previous phone of mine, it worked fine with a stock ROM with a bluetooth-based RCE, but upgrading to a custom ROM would have meant it was 'insecure')
11. Pxtl+Ki[view] [source] 2025-08-25 23:57:45
>>petral+(OP)
Uh, my bank has a pretty good mobile website, personally.
◧◩◪
12. Pxtl+7j[view] [source] [discussion] 2025-08-26 00:00:25
>>debaze+u6
Android apps will be the IE6 activeX controls of the future.
◧◩◪
13. markas+Qj[view] [source] [discussion] 2025-08-26 00:05:50
>>debaze+u6
What bank is this? No bank I know /requires/ you to use a mobile app for anything; the web is enough. 2FA can usually be done via email, SMS, or a google-authenticator-compatible app.
replies(2): >>debaze+Hv >>jlokie+GJ
◧◩
14. jiggun+uk[view] [source] [discussion] 2025-08-26 00:11:06
>>GeoAtr+08
Then use a laptop instead? Or you have one of those "modern" banks that's app only?
15. kelnos+ro[view] [source] 2025-08-26 00:51:45
>>petral+(OP)
I love how so many of the responses in this thread are "it works for my particular bank" or "my bank's website is good enough" or "I'd only need it to deposit checks, but I never need to do that"... as if those are actually helpful responses to this general problem.

Many many people have banking apps that will not work on non-Google-blessed devices, use banks that have mobile websites that are terrible, and need to do mobile check deposits (which is usually only available in the app, and not the mobile website, if the bank even has one). And no, we're not going to "change our bank".

The reality is that there are so many things that break, sometimes in subtle ways, when you try to use an alternative Android OS. Some people may not have any problems, and that's great! But many -- I would dare to say most -- will.

And there's also a ton of uncertainty: I don't really want to wipe my phone, install GrapheneOS, spend hours messing with it and setting it up, only to find that something critical doesn't work, and now I have to flash back to the stock OS, and hope I can restore everything the way it was.

replies(1): >>tootie+0r
◧◩
16. kelnos+Po[view] [source] [discussion] 2025-08-26 00:55:39
>>miloig+E2
This is a good start! I think we need something like a ProtonDB for this sort of thing, but that covers all apps, not just banking apps.

I do see five banking apps I use listed there as working, which is great. But -- and maybe I'm being unnecessarily overly worried about this -- what about the future? What if I've been using Graphene for a year or two, and one of the ones that's critical for me changes how they operate, and Graphene no longer passes muster as a platform it will run on. I'm not afraid of this happening at all running Google's stock OS image, but once I do my own thing, I get to keep the pieces when it breaks.

◧◩
17. kelnos+0p[view] [source] [discussion] 2025-08-26 00:57:09
>>ethagn+64
Unfortunately I have checks to deposit every couple months. And my bank has no physical presence, so the only way I can do it is through the mobile app. (They also accept deposits by mail, but I'm a little wary of that; a lost check would be a huge hassle.)
18. beefnu+3p[view] [source] 2025-08-26 00:57:19
>>petral+(OP)
Is that a jab at grapheneOS ? Because thats just another thing that google is borking up. And a little bit more so the banks themselves.

GrapheneOS is the way that all phone operating systems SHOULD be made. Layers and segregation between your banking apps and all the privacy breaking trash and malware you can get off the app store.

It is the banks and google making weird rootkit shit to try and lock down things that is the problem here.

◧◩
19. tootie+0r[view] [source] [discussion] 2025-08-26 01:15:22
>>kelnos+ro
There's bound to be tradeoffs between scrappy open source communities and trillion dollar industry behemoths. The fact that it's this close of a call is pretty amazing. And really you can blame your bank for not making a usable mobile site. A lot of businesses like to force users into apps because it helps with engagement metrics, not because there's any functional benefit.
replies(1): >>const_+Fo2
◧◩◪◨
20. debaze+Hv[view] [source] [discussion] 2025-08-26 02:01:50
>>markas+Qj
I should say that I'm not from the US, so that might be why you haven't heard of it.

There is also an alternative for now, but nothing as simple as SMS or authenticator app. They give you a special credit card shaped card with a card reader that you can use to authenticate with using your PIN, which is mostly considered legacy now with the bank app. It's also not realistic to be carrying this thing around everywhere either as it's bigger than my phone.

There is also a national ID app that is used everywhere that I'm worried will stop working on GrapheneOS... Because without it I won't even be able to access online government services like healthcare, taxes, etc.

replies(1): >>Klonoa+Jw
◧◩◪◨⬒
21. Klonoa+Jw[view] [source] [discussion] 2025-08-26 02:10:23
>>debaze+Hv
You still haven't answered their question.

Which bank?

replies(3): >>debaze+zz >>canada+0C >>bcrave+uC
◧◩
22. platev+gx[view] [source] [discussion] 2025-08-26 02:15:40
>>VLM+05
This is absolutely insane. If you block access, does the app stop working?
◧◩◪◨⬒⬓
23. debaze+zz[view] [source] [discussion] 2025-08-26 02:36:26
>>Klonoa+Jw
I don't want to reveal where I'm from so I can't say which bank specifically.
◧◩◪◨⬒⬓
24. canada+0C[view] [source] [discussion] 2025-08-26 03:05:32
>>Klonoa+Jw
I don't know the bank they are referring to, but I can cite an example for me: RBC Royal Bank of Canada requires the mobile app. There is nothing you can do on their website without first 2FA via their specific mobile app, and even then only in limited transaction sizes. If you want "full access" (e.g. up to $10k daily transfer via e-transfer) then you MUST use biometrics and the mobile app.
◧◩◪◨⬒⬓
25. bcrave+uC[view] [source] [discussion] 2025-08-26 03:09:51
>>Klonoa+Jw
I am quite sure Starling Bank requires an app if you still wanted an example.
◧◩◪◨
26. jlokie+GJ[view] [source] [discussion] 2025-08-26 04:32:18
>>markas+Qj
For example, Starling Bank in the UK.

They have a nice web app, but you must use their mobile app to login on the web version. The app takes a video of a QR code on the web page during login. Web login completes as soon as the mobile app notifies the server. There's no 2FA code to enter, and no alternative.

I asked them about this, by phone call, when my phone screen broke and I urgently needed to make a transaction. Surely there as an alternative? Or could I do the transaction by phone call?

They told me that indeed there is no other option. Despite having phone customer support, they had no phone or web banking service at all which could be used without a registered mobile device. The only phone service they could perform was to register a new mobile device, which I didn't have. I had a tablet, but it was too old.

So I had no good choice. The Android phone I'm using right now was bought in a hurry just so I could be allowed to make a bank transaction.

It wasn't my first choice of phone. I didn't have time to investigate alternative devices, let alone weigh up open alternatives. I ended up buying a mid-range device under pressure that seemed ok and was available in a store without waiting. (It was a brand new Samsung, and despite the IP rating it got water damaged and stopped working entirely after a few splashes a year or so later, but I was able to get it repaired.)

replies(1): >>seanw4+vt2
◧◩
27. lan321+AP1[view] [source] [discussion] 2025-08-26 13:47:47
>>GeoAtr+08
This is probably the only real solution. It also makes sense from a getting mugged or breaking your phone perspective. At this point, my phone is probably more important than my IDs and passports.
◧◩◪
28. const_+Fo2[view] [source] [discussion] 2025-08-26 16:22:48
>>tootie+0r
Its not even a matter of tradeoffs - banks just suck major ass so, of course, their piece of shit apps are extremely fragile and only work under just the right conditions.

That's not any OS' fault, that's banks fault. That's been my experience with every bank I've used so far and yes - they often break on certified OS' too! I've been on the phone with support!

Because they make bad software, period, and we're all just forced to use their bad software.

◧◩◪◨⬒
29. seanw4+vt2[view] [source] [discussion] 2025-08-26 16:41:54
>>jlokie+GJ
Sounds like you should find a new bank. I would, at least.
[go to top]