Hacker News Reader

Comment by goethes_kind | Hacker News Reader

What do people with Linux phones do about banking apps? All my banks force me to do online banking through an app (at the very least used as a security token generator). I would really love to have a Linux phone but I'm stuck with Android because of that.

View on HN

Honestly I recommend switching banks. I don't use a linux phone yet but I just tested my credit union's web site[1]. Not only does it work but it has a mobile version that seems -- now that I look at it -- more functional than the app.

[1] Security Service Federal Credit Union

> more functional than the app

given the increasing insanity that is getting a mobile app published and updated, I'd say that this will be normal than not in the future.

you need a team devoted to keep up with the monthly threat of your app getting removed because some new requirement. the upkeep is terrible.

I use a local credit union as well and also just use their website.

As someone who builds the banking apps of joinatmos.com, uses linux on desktop and aspires to use it on phone - I’ve been thinking about this too. Our react native build won’t support Linux (say, Flathub) very well at all, and building a separate GTK app is not cost effective for a startup. Flutter could work, or if we’d made our mobile app a wrapped website in Cordova or whatever that would have been an option I believe too.

For now, our mobile Linux users would be “stuck” with the mobile web experience, though we tried our hardest to make it a performant PWA that you can pin to your home screen. The main thing you lose is persistent biometric login, though many privacy conscious users seem to not trust biometric unlocking of your session in the first place (they mistakenly think their Face is being uploaded to our servers, which is of course not how the technology works on iOS/Android) so that may not be an issue.

Edit: From my time trying to use a dumbphone as a daily driver a few years ago, cash apps were a bigger problem (Venmo, etc) as theres a social component to “not paying someone back until later because I dont have a smartphone”.

though many privacy conscious users seem to not trust biometric unlocking of your session in the first place (they mistakenly think their Face is being uploaded to our servers, which is of course not how the technology works on iOS/Android)

For me, my hesitation with biometric unlocking is due to it being legally weaker than a passcode.

https://www.biometricupdate.com/202007/another-federal-court...

I see good point.

I dunno about you, but I'd prefer it all just work via Firefox, so assuming that's functioning, you'd have my business.

Instead of Cordova, you might want to try Tauri. https://tauri.app/

Genuinely curious here. Not trying to be critical. Why is a bank app necessary in the first place? Modern mobile browsers can run a pretty impressive HTML and JavaScript site, and I don’t have to worry about being forced to upgrade at an in opportune time.

PSD2 certification - you must have some way to implement 2FA and a lot of banks prefer using an app for this that they can also use to gather information about customers than using strong authentication methods.

I know a bank that makes you type your credit card PIN key after receiving an SMS in a mobile site... (cannot disclose which one).

Most banking sites log you out very aggressively, and a lot of them require some sort of 2FA during login. It's quite inconvenient to have to do this login dance every time you need to make a transaction -- with an app, you can use a PIN or biometrics to start using it.

If SafetyNet checks are not a concern, several people used banking apps inside Android runtimes (like Waydroid) on their Pinephones. Clearly not ideal for everyday operation, but for occasional tasks it does the job decently well and the overhead is low

I stopped using my bank's online service the day they required a proprietary service[1] installed. It is very inconvenient, I have to go the physical agency to get info I could get from my pocket anywhere, but that is the price I'm willing to pay if they require me to continuously run proprietary code on my own device.

[1] https://seg.bb.com.br/passo-a-passo.html?system=Linux

Interesting to hear this. I'm getting a bit annoyed about too much reliance on iOS/Android apps myself, but at least for most banks around here I still have the option of alternatives. I do miss my printed out lists of verification numbers, but I could pay for SMS delivery or get one of those smartcard readers.

Which, now that I looked it up, seem to be a German peculiarity.

https://en.wikipedia.org/wiki/Transaction_authentication_num...

Another annoyance lately is traveling. I need two apps for the car sharing services, two for public transit, maybe another handful for scooters/bike rental etc.

The best I can advise is try to access it via the online banking website, if available. Otherwise, you simply cannot use mobile banking apps unless you have some way to emulate a sufficiently "verified" Android environment somewhere (on your phone or some VM somewhere else), and use that to open the app.

I would never try to do online banking on my phone if possible.

The banks have however decided that issuing separate security dongles is too costly, so instead they forced us all to install an app that acts as a security token. So I cannot do online banking without the mobile app.

I changed banks over their requirement of having an android or apple phone. The clerk gaped when I told her I don't have a smartphone.

I would try to call them and flat-out tell them that you don't own a smartphone. Just tell them that you're using a dumb flipphone to communicate. Maybe they have a way to authenticate via SMS or alternative means. Else that would mean that peopler from an older generation who still don't have smartphones are just excluded from using this bank, which would be strange.

Else your only option is to buy a cheap android phone which you only use for this login. In a way that makes your banking activities even more secure because you're only using the device for 2FA codes :)

Except this insecure, non-updated device would also be sending tonns of data to Google continuously.

I know that security cracks will not like what follows - If you only use it for 2FA codes, does it really matter?

It matters, because your insecure device will be sending data to outside servers without your control, possibly with buggy software interceptable by hackers. So your 2FA codes could be technically intercepted before you know it.

In what country? In the UK I've never been forced (or even encouraged) to install the banking app. Which is lucky, becuase I'd sooner switch bank.

In Finland, you have to use a bank's authentication service to do pretty much anything. Most people use a mobile app for that, but paper codes work as well.

Also in the UK and have no idea what you're on about.

All major banks require app-based authentication. Many also offer sms as an alternative, but this is being phased out across the board. A handful maaaay still allow you to do banking via physical cardreader verification if all else fails (and you have no record of having ever installed an app).

> All major banks require app-based authentication [...] A handful maaaay still allow you to do banking via physical cardreader verification [...]

Uhm no... I can personally attest to at least Barclays and Natwest allowing you to use a cardreader + website, no apps needed, all online services available through website. Those are 2 of the top 4 largest banks in the UK, I wouldn't be surprised if it was a similar story for the rest. I imagine they would get in pretty deep legal trouble if they forced people to use smart phones.

Just because you don't try to use stuff without an app doesn't mean it doesn't exist anymore, I don't have a smart phone - life is good in the UK.

These are all slowly being phased out. That's the point.

I'm on Natwest too, which is one of the banks I'm actually referring to. As soon as I installed the app (for unrelated reasons) it started requiring it for authentication, even though I never chose that as an option, and it persisted even after I had uninstalled it. It is not impossible to work around it, but it's definitely not a pleasant experience, especially not when dealing with payments.

My recent experience is that Natwest at least has been adding 'friction' for doing things without the app. Case in point, I needed to change my address recently. I explicitly wanted to avoid the app, because it mandated establishing a biometric password. I tried the website, the website redirected me to a telephone number. I called the number, 30 minutes later, it happily informed me that "Great. What you're trying to do is possible from the app. Why not download ...".

In the end I took half a day off from work and went to the bank in person and asked a human to update my details. But judging from other industries, and seeing how the app is being pushed, I have no expectations that "human customer support" is going to be a thing for much longer (except for the typical "Helloooo I'm here to walk you through the app via a script I cannot deviate from" annoying kind).

Wait a second, (I'm curious because here in Australia this thing doesn't seem to exist) is this limited to their mobile site (you need app in order to log in on your phone), or you actually need to have a phone with you when you access online banking on your desktop? If it's the latter, that's crazy, what if you don't have a smartphone? That would be a complete deal breaker for me, I would switch to a different bank

All I can say is that I bank with two mainstream high-street banks and use password + SMS authentication, with the option of a card reader.

No good solution. Perhaps a cheap Android for $30 just for those apps... Maybe running Android in a VM inside a computer would work for that?

That's what I plan to do.

But $30?

~100€ is the minimum I've found. Do you have a link? Or maybe you meant non-Android...

$30 and even less is not uncommon for an older, slightly scuffed up, used phone. Or maybe you already have one, laying far back in your desk's drawer. Not a kind of phone most people would use as a daily driver. But as a dedicated bank-app thing - sure, why not.

Just don't connect it to untrusted wifi, disable bluetooth and all that. Chances are - that phone had its last OS update years ago, and could be pretty easily pwned [0]

[0] https://gist.github.com/jesux/64cf037c55c0d42196762c0ccacc73...

Personally, I'm using Anbox to occasionally run a single Android app on my Librem 5 and it's a banking app (Polish mBank), which works fine with it.

For what it's worth, that app isn't actually necessary, but comes with some handy features that aren't available on their Web frontend like token-based payments that can be used in ATMs or shop terminals without using a card, which is what I'm using the app for (regular payments can be easily made via the browser).

Yes, it's insidious isn't it.

I wish I could say the answer is to find a bank that doesn't do it, but there don't seem to be any. The whole thing verges on apocalyptic.

Personally I hadn't heard about this until a minute ago, which means that luckily there are banks that don't require a mobile app...

I guess it depends on how much you use it?

On the Linux phone itself, you can try out Waydroid https://waydro.id (and it seems to work on regular Linux too?).

I also think there are Android Distros you can install in a VM as well (though I admit I have not tried it).

Nordea gives you paper codes when you sign up. You can do everything through their website as long as you use those codes for MFA. Each time you authenticate, you have to use the next code in the series. Once you run out, you go to the bank and pick up another code book.

In the US in my experience, it seems like all banks rely on SMS or email-based 2-factor. I’m sure that will change but our financial institutions are perpetually behind the times. So at least for American users, the lack of banking apps isn’t much of an issue.

My bank (comdirect in Germany) fortunately has an okay mobile-friendly website and sells a tiny hardware device to generate the "TAN" for their weird proprietary way to secure transactions.

Personally I don't do online banking on the phone, but your mileage may vary depending on your needs and how often you are away from a desktop.

Not everyone uses banking apps?

Are the requirements different in different parts of the world? I've never used a banking app, I just use a web browser on my desktop.

I didn't use banking apps when I used Windows Mobile for years, but the big thing I've since found handy is mobile deposit. Generally without a phone app, you have to drive your checks to the bank.

My bank has a website where you can do banking online, and I use that.

Wonder could you write one with Plaid.

The Venn diagram of Linux phone users and people who want to reduce proprietaries in their life is rather big. That's to say it's almost the point of the hardware to point you these problems. And in my opinion, frankly, your anecdote is more about your choice of bank and not which phone you use.

That being said, what about banks with open APIs? Wasn't there some EU legislation?

It's "open" api for some bullshit aggregation data slurping services, not for normal customers to access their data directly and easily for themselves on their own hardware in automated way. There are banks with nice XML/JSON based API specially made for easy syncing and login via API keys you generate in a normal bank web UI. But those are very rare.

If anything EU fucked up all my bank automation, except for this one bank, by requiring 2FA just for logging in, and not only for making transactions.

Reply on news.ycombinator.com