Hacker News Reader

Comment by traxler | Hacker News Reader

For all the "My Banking Apps don't work", I'd raise one question:

Do you really need access to banking apps on the go? I get that it can be handy and maybe you legit do, but I'd wager most people don't really do. If you can pay by phone you can pay by card and the card has less potentially to weirdly break.

And if your bank demands a phone app to be used, you can always have a cheap stock android lying around at home. Can't get stolen or lost. Doesn't give big G any data on you, because that phone doesn't have anything but those apps.

But I also understand "just have a second phone" is not a tempting idea for many people. I am not much of a phone person, so I'm not a good case study, but it works fine for me.

View on HN

I cannot speak for every country but in the Netherlands, your banking app also serves as a 2FA instrument if you place orders with your credit card. A pop-up notification will ask you to confirm if you have indeed placed the order. While I will admit that it is possible to predict such use cases and take your phone along, it is becoming a bit difficult to predict what part of some account or service's login flow will require a confirmation with your device.

Luckily, all/most Dutch bank apps work on GrapheneOS.

(Not saying that you claimed they didn't.)

Huh, interesting. I only have those 2FA popups for card payments online or in apps, never for payments in stores.

Certainly in the UK you can get the 2fa app popup in store if you tap to pay with your phone rather than a card. It’s analogous to going for a contactless payment with a card and them asking to insert the card and type the pin (which sometimes happens). It’s pretty rare (as in I have done the vast majority[1] of my payments using contactless on a phone for a couple of years now and I think it’s happened once to me).

[1] Like probably 99%+. I scarcely ever have a card on me and never use cash.

I'm pretty sure that's what your parent is describing.

In my case, I often spend multiple days at my parents' house. Now, I mostly don't order online, but sometimes something comes up and in that kind of situation, most merchants will have me go through the verification.

Since this doesn't happen frequently, I'm more likely than not to not have hauled my secondary phone, especially since I very much prefer traveling light. Now, could most of those occasional purchases not have waited for my return home? Eh... most probably could've. Doesn't make it less annoying, though, for no good reason.

Based on this resource, it seems there's very extensive testing of banking apps on grapheneOS, and the large majority works.

https://privsec.dev/posts/android/banking-applications-compa...

Indeed, and based non-extensive, one sample approximate average testing, my own bank works like a charm on GOS.

I've used GrapheneOS for years at this point and all my banking apps work fine. It's just definitely worth a try.

I've had a government app not working once and one of the devs actually showed up on the GrapheneOS forums and now it does.

In the UK at least, banking apps are how you give people cash when you owe them for dinner, drinks, whatever. It's also needed to authorise online payments. And for travel, location services is often used by the better banks as an alternative to immediately blocking your card every time you go anywhere. Then there are account perks[0] like airport lounges, co-working spaces, exercise classes, etc. that all use the app for access.

It'd be more than just a bit inconvenient to lose all of these things…

Luckily, all of my personal and business banking apps work fine on Graphene. Even the apps for the crusty old "bricks and mortar" banks that I still have backup accounts with.

[0] As an aside, Revolut Ultra in the UK costs less than the FT Digital subscription it includes so if you're an FT subscriber, all the other stuff that comes with the account is cheaper than free.

> And for travel, location services is often used by the better banks as an alternative to immediately blocking your card every time you go anywhere.

I routinely use my (U.S.) credit card abroad and never had issues. I don't have any banking app on my phone, which runs Graphene, because I do not need access to banking on the go. Things such as airport lounges, co-working spaces, exercise classes, may be valuable, but none of these things is more important than my freedom. I do not tolerate the thought that some company may track which services I use and where I go without my consent. I therefore do not use proprietary apps on my phone. If something does not work in the browser (Vanadium), I will do without it.

Some info in case someone is on the fence about this, and are living in the UK. I use Monzo, and that works perfectly on GrapheneOS.

If they ever stopped working, I would just CASS to another bank. A bank that has a posture that something like GrapheneOS is too insecure to use their app on is a bit of a red flag.

Mobile apps are how most people do banking these days, and it shows. In my experience banking apps are a lot more maintained and modern than classic online banking interfaces.

So you're not just sacrificing "on the go" banking, you are likely sacrificing use of the best interface your bank offers.

Also, most smartphones (especially GrapheneOS, iOS, Pixel, etc) are far more secure than desktops/laptops. So also from a security perspective it's better to do banking on a phone.

And it’s very hard to actually steal a cellphone since it’s always with you, whereas houses get broken into all the time.

This has to be some fascinating regional difference, because my personal experiences suggest the opposite. Would you be willing to elaborate ( in general terms/locations if too sensitive )?

I wonder if phone theft specifically hasn't (somewhat) gone down now that most are encrypted and tied to some online account by default. Maybe criminals have heard about this, and they focus on other things.

Where I live, people still carry cash (though not absurd amounts) and credit cards, and I understand that's what most pickpockets are after. Especially since, after covid, the limit for contactless payments has increased.

Burglars recently broke into my parents' house and they left the MacBook and iPads. Most informed thieves probably know that they are bound to an account, can easily be blocked, and there is no use trying to sell them.

I would assume its more and more the case with phones as well. ~10-15 years ago I heard often about smartphones getting stolen out of people's pockets, etc. Not so much anymore.

Non-Apple laptops is probably a different game.

True but you can also argue the opposite since its a lot easier to loose it and more exposed to more people that could be thieves.

Unless you use Qubes OS (which I do).

Maybe, but this is irrelevant to 99.99% of bank users out there.

It means that banks cannot say "desktop is insecure, therefore a mobile app is required for your security". I can manage my own security in a better way.

I don't have the same experience. My main bank is a huge European bank, and their app is laughably bad. You have to jump to an impressive number of screens to reach anything other than "last / upcoming transactions" lists. Many are actually just janky webviews, yet they still somehow manage to work worse than their website. Bonus points for it being "temporarily under maintenance" seemingly every other day.

I should note that the website is pretty janky itself, but at least it works fine (meaning "not worse") on Firefox on Linux, and it doesn't even pester me to change browsers or anything.

I also have an account with one of those new "online" banks for when I travel, since they have better exchange rates, and, importantly, no conversion tax. Their app is somewhat better, but they have no website whatsoever, AFAIK. But, at least, they allow me to set up a proper password instead of clicking on 6 digits as the other bank.

Is the UI really that important though? I assume most people use internet/app banking mainly to do two things: make payments, and look at transactions. I also assume most people don't do these things very often. Sure, a good UI is nice to have, but it isn't going to affect my life much if it's missing.

Sadly true, while not being a phone person, I have started using my home banking phone for tasks I used to do on my desktop. Still never leaves my office.

> Do you really need access to banking apps on the go?

Not strictly, no, but it's useful to be able to relatively-quickly check my balances (and possibly shuffle funds around between checking/savings and my credit-union-issued credit card). I could use my credit union's website for that, but it's faster to open the app and scan my thumb.

Thankfully, my credit union's app has no issues with GrapheneOS, aside from needing to enable “exploit protection compatibility mode” to keep it from crashing on startup.

I've never used a banking app on my phone, and I have no desire to. It's the least secure device I own (in spite of running Graphene). It's the most likely device to get lost or stolen.

I currently have accounts with 3 different banks in Belgium. They all offer an app which I ignore. Online banking works just fine, heck, better than fine, it's excellent. One bank uses auth derived from my debit card (which I have to insert into a card reader to sign transactions). The other two use hardware tokens. The hardware token for my business account has a built in camera which scans QR codes displayed by the website. When signing a payment, I scan the code and the token asks "Confirm payment of 123eur to XYZ?".

It's plenty convenient for my needs.

That's fine when you're lucky enough to be able to avoid a banking app, but for many banks its essentially compulsory. I can't login to internet banking without entering a 2FA code from the app. I'm even forced to have my Android settings a certain way, otherwise the app detects that my phone is "insecure" and refuses to run.

> for many banks its essentially compulsory.

I would look for a new bank.

I need my main one for paying friends back and for authorising payments online. Luckily it works without google. The only real app I miss is Uber

> Do you really need access to banking apps on the go?

Yes, I do.

I'm considering using a second phone for increased security. As you say, only put banking apps on them, leave it at home.

The larger population is getting pushed towards banking on the phone, and on top of that, many people don't own a PC/Laptop anymore.

Same here - all the German banks I know of the phone app is mostly for 2FA, but you can also use it for banking, if you like.

In my case it's also the 2FA for credit card usage (as I have the visa/mc via my bank), not only bank transfers.

> If you can pay by phone you can pay by card and the card has less potentially to weirdly break.

Paying by card in 2026 is akin to sending physical letters.

Really? I guess my neck of the woods is more backwater than I thought. While paying by phone is by no means rare, paying by card is very common.

In Sweden you use BankID to authenticate to websites and it's almost a requirement nowadays.

Luckily it works well on GrapheneOS though.

yes. I pay with bank transfer on regular basis. Merchant generates a QR code, I scan it with my banking app and I pay him.

USAA works. They detect there is not attestation and warn you, but give you the option to continue.

Sorry but thats a statement thats just willfully ignorant. Yes people need to have access to their financials when under way. That can range for PushTans, CreditCard Confirmations, to checking their budgets, moving something from one account to another, topping up your Prepaid Card. Or just being able to Pay with a Card on your Phone when you forgot your Wallet.

Sure you could say I do not go out and do not need that but realistically this is just how the world works now.

I very purposefully added both the "and maybe you legit do" and the fact that I'm a bad case study.

Sorry if i may have formulated this a bit harshly. I may have replied to your comment becaause it was far up and its a common argument. Often made in bad faith.

How about using cash for all of this? This has the added benefit of not enabling tracking by financial institutions in addition to tracking by Google, the phone OEM, and possibly other third parties.

But you can do all those things via a browser.

That's demonstrably false.

You don't get TANs in the browser, can't tap "approve" on the application-only notification, can't pay with the banking app (for those banks which offer it) without the banking app.

...and willfully ignorant given that some banks are mobile (app) only.

You can pay with a card on your phone? I mean, sure, if you are buying something online. Not with contactless I think

You can do all things with a browser and a card, yes.

I'm assuming that most people will carry the card with them anyway.

Sure, if you are ok walking around with a card. I've been "walletless" for the past 6 years or so, and I don't want to go back.

Leaving and coming back home and only have to mentally track one object that I can't forget is great. If it breaks, I'll temporarily use cards or physical money until I get a new phone and install everything again.

"Use a card" is not really a good alternative for those that prefer not to use them. Sure it works for you, but not everyone has your preferences of walking around with a wallet.

Some people will suffer some inconvenience for something that they think is worth it and some people will do everything to no do anything because it is too much trouble. Sometimes they are the same people but in regards to different areas. For example I would never grow my own carrots. What for? I can buy them. And my wife would never built self hosted media server. Why spend 5k$ on PC when you can just buy Netflix?

And there is 3 kind of people that do one of the above and go around in real life and online and tries to convince everyone that THE THING that they are doing is THE ONLY, TRUE SOLUTION. Like vegans or cyclists.

In reality none of this is true. If Graphene OS would tomorrow became, magically the only mobile OS in existence they would became next evil tech company in few years. Because power corrupts.

I have troubles discerning how this answer connects to my post.

Are you putting me in the third kind of people?

My intention was rather to discuss why you even attempt that kind of discussion. I mean if someone is so glued to their banking app let them have it.

But I see I already was down voted. So yeah...

Reply on news.ycombinator.com