Ask HN: Implications of open-source banking apps? | Hacker News Reader

Ask HN: Implications of open-source banking apps?

5 pointsp3nm89 comments

In the move away from proprietary services on the Android Platform many have experienced difficulties with the SafetyNet mechanism, especially regarding certain banking apps.

As there aren't any alternative FOSS apps, the customer cannot use these banking applications as intended.

I was therefore wondering, what would be the implications for an average, mid-sized bank, to go completely open source? How feasible is it building such an app/transaction system especially regarding privacy and security measures (required by law)? And lastly, what organizational changes within the bank would be needed to make an open source friendly banking system possible?

This is hypothetical and solely out of curiosity. I am looking forward to the discussion. Thank you very much!

View on HN

Kinda fun to think about lol

- catching up on 0days: as organizations grow in headcount, their internal review and release processes naturally becomes slower; inversely relative to the amount of programming languages, frameworks, tools they involve in their toolkit which grows overtime. put out everything publicly now everything is a possible attack surface.

- incentives on finding vulnerabilities: should you get $1k to 100k on bug bounty, or should you steal $1m to $10m when you can?

- complexity on international scale: consider large fraudulent transactions through banks A, B, C where each bank is headquartered in different countries. will those banks comply / cooperate? up to how much is insured? how long until users get their money back? up to what point will law enforcement agencies can be involved?

These are many points I haven't thought of, thank you. Are you implying, that in the end this would pose a risk to the whole network or otherwise would it require to be somehow open source friendly as well?

Ok so I was thinking about this as well while I was at one of those modern mobile banks.

With closed source apps — as soon as you write for the JVM or in JS (i.e. Android and Web), you’re exposing the inner workings of your app… more or less. With C/C++ and similar stacks (read: Desktop or iOS or native parts of Android), one could argue that you expose less. But still, all code on clients is exposed, theoretically, so either way I don’t believe that open code itself would be much more problematic than what code is today in closed source apps. We did a bunch of things that are considered safety measures, and those could be coded into an OSS app as well.

But then, there is network encryption, potential implementations of cert pinning, integrations with other services/tools, secret keys, local storage, databases, and many other things that might be hard to lock down completely or even audit for security risks… this was the really tough part I believed. But maybe it’s just my knowledge gap, that’s fair as well.

In the end, my thinking was “omg I’d miss something for sure, and it would be easy for hackers to kill the project and steal everything”… and therefore OSS is not the way to go. I’m more confident nowadays. But then again, cryptocurrencies are open for the most part… so that’s an interesting counter-argument I guess. (:

I wonder what others think. I also wonder if there are open tools or checklists for security audits…

Why do you need a "banking app" at all?

Why not just use a banking web site, which already exists In most cases?

The only real "service" that most banking apps offer that isn't available on a web site is photo deposit of paper checks. Paper checks are kinda last century and are rapidly declining anyway. Oh and privacy invasion --- an app makes it so much easier.

I agree with you here. In itself best would be to not use online banking at all. As I said, this is hypothetical and doesn't apply to my personal situation (anymore). I just realized it the first time after degoogling and seeing this being a struggle many have when transitioning to a degoogled device, it kept me thinking.

Nevertheless, using a banking app is very quick and convenient and is therefore used by many people. I don't see privacy education going that far, that people would abandon this convenience. Therefore I was wondering if an open source application would be possible here and bring the benefits that OSS usually offers in other circumstances.

Nevertheless, using a banking app is very quick and convenient and is therefore used by many people.

It's used by most people because they've been taught to think "app".

Most people don't even know they have an alternative --- they don't know that they can easily make a link on their home screen to any web site that will look and function just like an app.

"Progressive web apps" even remove the browser interface so the casual user can't tell that they're not using an app. Chase; for example, has one.

It's also amazing how many developers don't know about PWAs and how they can be used to bypass the politics and extortion of app stores.

https://en.wikipedia.org/wiki/Progressive_web_application

This is very interesting, I did not know about this either and will look into it. Thank you very much!

Would you suggest that rather than having discussions like my original question, we should better think about how to take different implementation approaches, thus circumventing several issues which come with 'traditional' apps?

Personal opinion --- most of the "apps" on people's phones could be easily replaced by PWAs with no real loss of functionality.

The only reason PWAs aren't more popular is because app stores don't earn anything from them and they can't be used to data mine your phone.

I see, this seems to be an unfortunate consequence of the 'app ecosystem'. I'll keep that in mind, thank you very much! :-)

Reply on news.ycombinator.com