Hacker News Reader

Comment by denysvitali | Hacker News Reader

At least in Switzerland banks can choose to not use Play Integrity, but they generally don't want to.

Yuh, which once was owned by both Postfinance and Swissquote, works without Play Integrity. Support for GrapheneOS is confirmed - see https://github.com/PrivSec-dev/banking-apps-compat-report/is...

The real issue is that most "legacy" banks have to comply with stupid regulations that force them to come up with these stupid solutions.

Banks are lazy and find the quickest way to comply with said regulations - simply by enabling Google Play Integrity.

About the whole US thingie - yes, that's true, and it's what happens if you get sanctioned. I'm pretty sure russians (and other people from sanctioned countries) have similar limitations elsewhere. In Switzerland US nationals have huge problems in opening accounts because of the whole bank secrecy law that allowed many americans to hide money from the IRS in Switzerland.

View on HN

I use GrapheneOS in Switzerland and am yet to find a bank or financial app that doesn't work. ZKB, UBS, Cembra, BEKB, SGKB, WIR, N26, Revolut, debiX+, SaxoTrader, Swisscard, various TWINT apps, YAPEAL and Yuh are all installed on my phone right now and all work. Most of them don't use the Play Integrity API at all and the few that do are satisfied with the minimal level that's satisfied by GrapheneOS.

The catch is that you need Google Play Services installed and for many, you need to disable GrapheneOS' "Secure App Spawning" feature, which often trips root detection heuristics.

I know many Russians living here and when sanctions came in, their accounts became unable to receive deposits until they provided evidence of a valid residence permit. Some have problems during permit renewals as well but overall, it's nothing like as bad as it is for Americans.

Are all of these apps only available through Google's Play Store repo, or are any of the available as an apk file directly from the bank's site? For some reason most companies only distribute their apps through Google and Apple's repos. People shouldn't have to have an account with and agree to a third party US company's ToS just to download a banking app.

Why are Google Play Services required?

Genuine questions - I'm not from Switzerland and I don't have a Google account.

IIRC none of them is available from an alternative store

They're only available through Google Play. That's near-universal for commercial apps.

Google Play Services, among other things, is the main way to get notifications and location on Android, so any app that uses either of those things tends not to function if it's missing.

This goes beyond simply using Play Integrity, which normally just does remote attestation of the operating system. The next level is allowing an app to check its own package for modifications or installation from an unapproved source, but this goes beyond even that and gives the app the ability to check where a third-party app came from.

Google are assholes for building this.

> The next level is allowing an app to check its own package for modifications

You can't modify them. They're signed. If you modify and resign it gets installed with a different key (ie the one you signed with) hence it's a different app as far as it's concerned.

To get around that you need signature spoofing which Lineage famously refused to include.

Agreed that BigTech in general is making the world worse by implementing security features in ways that erode user freedom.

>"legacy" banks have to comply with stupid regulations

In the UK "banks are required to refund unauthorized payments". Is that a stupid regulation? I quite like it but you can understand why it would make the banks worry about being hacked.

If they get enough complaints "the app doesn't work, please fix it or close my account" they'll fix it because they don't want to close more than a few accounts.

No, unfortunately that doesn't seem to be the case. At least from experience :(

SafeNet != SafetyNet nor Play Integrity?

I thought it was just a spelling mistake. Is there really a "SafeNet" by Google? I wouldn't be surprised they made it even more confusing

Reply on news.ycombinator.com