Hacker News Reader

Comment by hparadiz | Hacker News Reader

I would caution the decision makers on this. The line between a secure device and a useless toy is perforated and hard to see.

View on HN

If I can't use banking or my NFC wallets on my phone, it has become 90% useless. The other 10% of usefulness is texting and calls, which every other phone can do.

Unfortunately, this mostly means using the closed android ecosystem.

No idea why you are even bringing this up. It works just fine right now.

It verifiably does not on open source and free android roms like Graphene. Unsure where you're getting your info.

No one even brought that up. We're discussing being able to install unsigned/self signed APKs. Please stay on topic and take your strawman elsewhere.

The ability to install signed and unsigned APKs directly correlates to the financial institution policy regarding mobile devices and banking apps. Unsure how you've separated these two.

[citation needed]

I run GrapheneOS and use several US-based banking apps. I'll not name them since I don't really want my HN account associated with my financials in any way, but I've got a mix of well-known national bank apps and smaller local credit union apps working.

I'll admit there is a single institution's app I've found that doesn't work, but that is just one of several that I use.

For me, the showstopper would be NFC payments. From what I understand, Google Pay doesn't work on Graphene. I have all my credit cards in GPay, as well as a transit card. I use it for boarding passes when I fly, and any other tickets/passes that support it, since it tends to be much more reliable than the airline or ticketer's app. I've come to heavily rely on it, unfortunately.

I haven't tried this, because I try to minimize Google exposure, but I think Google Wallet (minus NFC payments) works on GrapheneOS. So, tickets, boarding passes, etc. should work fine.

I use GrapheneOS with the Dutch ASN banking app and the ICS credit card app. Pretty much all other major Dutch banks work as well.

https://privsec.dev/posts/android/banking-applications-compa...

Google Pay does not work, but some other NFC payment apps do (e.g. Curve).

To you.

Laptops exist.

This is a common answer but it does not apply to at least most of Europe. Because of regulations most banks require to install their app either on iOS or Android to act as a 2FA device. One of my banks gave me a hardware device 20 years ago. When its battery dies I'll have to use their app and my fingerprint.

If you really don't have an alternative in Europe, buy the cheapest Googled Android device (less than $100 or euros), and use that as a glorified 2FA device. It's not ideal because you have to pay for it, but on the other hand Android devices with unlockable bootloaders (mostly Google Pixels now) tend to be cheaper than iThings. A Pixel 9a or 10a running Graphene for everyday use plus a cheap Android phone that stays are home are still considerably cheaper than Apple and Samsung devices, and give the users far more privacy and freedom.

When I was still rooting it was possible to bypass this on a rooted device with enough effort. It wasn't unsecure either. Padentic corporate security doesn't really make us more secure. Just more lazy.

Most European banking apps work fine though on a relocked GrapheneOS phone.

https://privsec.dev/posts/android/banking-applications-compa...

I'm using my GrapheneOS phone to log on to their web app without issues (though I typically only do banking on my phone, much more secure).

Yes, that's the endgame, an Android device in a drawer at home. But what do I have to carry on my pocket to use the minimum amount of apps? Firefox, WhatsApp with video and audio calls, Telegram no video no audio, a mail client, a YouTube client (possibly not from YouTube), a maps and navigation app (for cars), phone calls, SMS.

YouTube on Firefox is a much better experience than the official YouTube app, so you can drop one from the list.

I'm using NewPipe and PipePipe. Both are better than the browser app.

How do you install the bank app if google does not allow you to install APKs manually / with a 3rd party store? You have to go with Google Play. Which requires a Google account. So I can't do it. That's the whole point of this thread: it would not be possible to use Android without a Google account.

Have you talked or met anyone born after the 90s? Everyone banks on their phone, it's the norm not the exception.

Edit: Someone also made a good point, one of my CC's I can barely even manage without the app since the website barely works.

90% of your usage on your phone is banking apps or NFC payments? That seems hard to believe.

That's pretty much my usage pattern too, including some group texting, the occasional call and sometimes taking photos/videos. Otherwise my phone pretty much stays in my pocket or on my table the entire day. What are you using your phone for that makes that so unbelievable?

Web browsing (like right now), photos, e-books, lots of messaging, music, sometimes video.

I use NFC payments often, but I wouldn't say that amounts to more than a few percent of my total usage.

Everyone uses their phones differently, of course. I don't think your use is unbelievable or odd, but I do think your use patterns are not the common case.

I used my bank app yesterday, but since then I've used:

whatsapp, phone, push authenticator, safari (having followed a link from a message), spotify, slack, mail, calandar, disney plus and camera

Do you not do any of that on a mobile device?

I do use whatsapp, camera and the phone functionality, web browsing very seldom, mostly for "emergencies". Spotify, work chat, mail, calendar and watching entertainment is all stuff I either do at my desktop or on the TV, never use the phone for those things.

I don't know if it is generational or regional or what, but there is a solid segment of people that live in very close contact with their bank.

On average, people spend 4 hours and 37 minutes on their phone, per day [1].

I find it hard to believe someone would spend 4 hours and 9 minutes _per day_ looking at their banking app or using NFC payments.

[1] https://explodingtopics.com/blog/smartphone-usage-stats

Your assumption they used their phone an average time was false probably.

I run Graphene on my Pixel and banking apps just work. There is no Google Pay, obviously, since Google dependencies have been stripped out from the system. I just carry a credit card.

Even with the sandboxed Play Store, Google Pay disables NFC payments as it requires hardware attestation against Google's root keys.

No inherent reason all that stuff can't work on an open platform. It works just fine on my Linux box with yubikeys, fido2, and smart cards. Gcloud even let's you authenticate with them only to put a medium lived token in plaintext into a sqlite file on disk.

No inherent reason, just Visa/Mastercard requirements around host card emulation for payment cards.

Sounds like a duopoly that needs to be broken up.

Curve pay works!

Same, some banks even proactively fix things to work on GrapheneOS when customers ask.

>this mostly means using the closed android ecosystem

Maybe, but there's no technical reason for this. As I've mentioned before, I can do banking just fine on my Gentoo machine where the entire corpus of software on it, is FOSS and compiled by myself.

The line between a phone and a computer is what has been perforated. What I need is a modem. I don't need the modem baked into a computer that has a permanently affixed screen and battery. That then pretends to be some kind of secure enclave for my deepest secrets.

"Security."

As if I'm in the government or something. Why can't the people who need military level security get their own platform? Shouldn't they just have that already?

Reply on news.ycombinator.com