Also, how do I do all you said above? (I need a step by step tutorial). Also is it reversible? Are there any other security implications?
Depends on how paranoid your bank is. There's this SafetyNet thing that checks for "system integrity". It's part of Google Services. For now, it's possible to bypass these checks using Magisk, but I've read that Google is testing the new method involving TrustZone — a hardware trusted execution environment within the SoC where you aren't one of the trusted parties.
> Also, how do I do all you said above? (I need a step by step tutorial).
There should be plenty on xda-developers.com
> Also is it reversible?
On Google devices, yes, completely. You can reflash the factory images that Google provides and relock the bootloader. On others... it varies, on Samsung especially.
> Are there any other security implications?
If you leave the bootloader unlocked, anyone with physical access to your device will be able to reboot it into the bootloader and load arbitrary code with OS kernel privileges. From there they'll be able to modify the installed system. They won't be able to read the /data partition [right away] because it's encrypted with your password/pattern.
IMO it's really a shame you can't re-lock the bootloader with your own signing key.
But it requires you to set up your own build + signing server in AWS.
I haven't tried it, but I believe part of the reason that AWS is recommended is due to the build time.
Also, if the phone has a vendor supported way of unlocking the bootloader, it will typically also trigger a wipe / factory reset (presumably because to keep DRM enforcers etc happy).
Is it not possible to unlock the bootloader but modify the OS tell apps that the bootloader is locked no matter what? Can we do this with Xposed?
If you live in a country where you have to use your phone for banking and can't use the web then you need to talk to your politicians. That seems like a pretty extreme violation of your freedom.
As much as I dislike the US at least we don't have that.
- Barclays (App won't work with LineageOS, website is horrible).
- Monzo (App only, no website, works with LineageOS).
- Revolut (App only, no website, works with LineageOS).
- TransferWise (Web and App, both work well, but never tried it on LineageOS).
- ING Home Bank (App won't work with LineageOS, website is manageable, but still a pain compared to the app).
Of course I don't have to use any of these, but there are clear advantages to using any of them, depending on the situation (you wouldn't take a mortgage from TransferWise, split bills with Barclays, and hold foreign currency in Monzo, mainly because they don't support that). Also you don't have to use a phone, just walk around without one, make people email you instead of calling, and ask people for directions instead of looking at a GPS map.
My point is, I paid for my phone (me alone, nobody else chipped in) so I want to use every feature it provides without restrictions, as it is my property. That goes for both taking screenshots and using apps. And when it's not possible, I look for alternatives. Right now none are practical, nor feasible, so all I got left are tricks like scrcpy and rants on forums ;).
Just looked, and apparently Revolut is 1) app only 2) tied to a mobile number. So not only is it annoying to use, but likely also susceptible to sim jacking. Again, why would anyone want to use this; I hate having to deal with wells fargo (they bought a loan I have) but even they seem less crappy. Not trying to hate on OP, I'm just shocked at how crap their service appears to be.
You can't. That's why you don't use them for serious work.
> why did you even open an account
Different use cases, different circumstances. I don't depend on them but they give good exchange rates and zero fees when transferring or spending money abroad. It's the "it just works" and "fast and cheap" effect that the traditional banks don't have. And opening an account is done online, and you get access to your account in hours, compared to Barclays which took 2 months of ping pong, when I first moved into the UK (since I did not have a bill issued in my name at my UK address I could not open an account, so I could not pay my landlord rent so I could get an address to open an account, fun times). Without that Monzo account I could have not been paid in my first 2 months.
But if you want to know how crap Revolut really is, try contacting their support to report a bug in their app, they don't have an email, but instead ask you to get in touch with them on Facebook.
But seriously, not even a support email? Good God, I would trust PayPal with my money more than that; but I suppose they needed to hit all the fintech bingo buzzwords.
The Barclay's part is just an old practice. How I ended up doing it after two months was by having a letter from my employer stating that I'm registered with them at a particular address. But what I learned from somebody else that went through this, after those two months, is that they could have said my "home" address was the address the company is registered at instead. This is how they've used to do it with other people that have hit this problem, it just didn't occur to me to ask for something like this, and it didn't occur to them to suggest this either since they assumed I had everything in order (since I already submitted my Monzo account for salary payments).
Monzo only seems to have and login for their business accounts. For personal accounts it's still phone only. And business accounts are a recent addition.
Revolut has login now, but you can't do anything there, except viewing your balance and blocking your card. And this is a new thing, maybe and beta version, otherwise they would have officially announced it somewhere, like in the bragging emails they like to send from time to time.
I have two of those, and I chose them because of unique banking features (not the mobile app) not offered by other banks which I found valuable. It's nothing to do with the country.
To be honest it would be nice to have web access as well (or even phone banking), but we take what we can get.
During this pandemic I've found that to be a big deal, much more important than whatever technology or access method is offered.
I'd switch banks or at least branches to this new province, but my current visa won't allow it (and for whatever reason, you cannot transfer accounts but need to open a new one).
It's not only the challenger banks: nowadays banks will also encourage you to use their app for 2FA. You can use a proprietary token instead, but you'd have to pay for it (the app instead is free). 2FA sms is not supported with some banks (and that's good).
I think the UK is an exception, since for 2 of the banks I had accounts with, they just used a 2nd "memorable" password as "2FA" (avoiding the requirement of a smartphone)
Sometimes you don't have to, but it's much more convenient. For example, I can use my bank app just with my fingerprint. To use the web app, I either have to login with my phone (reading a QR code) or have to use one of those devices where you insert your card and enter a couple of codes (if I find it...).