Hacker News Reader

Comment by movsx | Hacker News Reader

Might someone know whether banking apps worldwide will work?

This site tracks the status of what apps work: https://privsec.dev/posts/android/banking-applications-compa...

The official GrapheneOS docs contains a developer guide on how to fix banking apps when they are not working. Bank app developers have been surprisingly receptive to making the changes, weirdly enough. You can see in some of the issues tracked on the site where people reached out and the developers eventually made the apps work.

I've been running GrapheneOS for a while (I have posts on the blog in my bio if you want to see some day-to-day info) and only one bank app gave me trouble. I had to toggle a setting and then everything worked.

Separate from this is wallet and payment apps which still have not had much traction on GrapheneOS.

> Separate from this is wallet and payment apps which still have not had much traction on GrapheneOS.

Curve works in Europe and Paypal has a trial thing in Germany for tap to pay IIRC. There's nothing in the US unfortunately, yet.

If you want more security and privacy, don't use your phone for payment - use your card.

I don't know if that's really significant. But yeah technically you give up less information by using the card directly instead. But it's like going from 98% privacy loss to 99%.

Cash and Monero are private so they're in a different space and are what should be prioritized.

It's more difference than you think. Your card isn't logged into Google, Facebook, Signal and so on. It doesn't route through Cloudflare. It doesn't even connect to T-Mobile, Verizon, or Stingray automatically.

> It doesn't route through Cloudflare. It doesn't even connect to T-Mobile, Verizon, or Stingray automatically.

I fail to see how that's significant at the banking level. What does Stingray mean in this context??? Signal??? It's just a messaging app. You can use a VPN or Tor.

Your purchases still go through all these routes on the payment processors side. And you can use Apple pay offline–it's just NFC.

You realize ever card purchase (when where what how much) is logged and stored for like 5+ years (probably forever). Yeah I'd probably prefer not to add Google to the mix but your carrier only sees DNS logs not the encrypted content.

If you want any privacy whatsoever in payments use Monero and Cash: https://eylenburg.github.io/payments.htm

Only two parties who are legally forbidden from sharing have those logs instead of 10 who aren't

Heh. USA user here. Several of the apps that say they work I have been unable to get to work.

So anyone reading this, be aware your experience may differ.

I'm on a pixel 10 pro and have never been able to get some of banking apps to work, despite the list saying they should.

It is likely a crapshoot, and while that list is informative it is necessarily a snapshot in time. FWIW, my banking apps have worked with no issues and have worked continuously since I migrated to GrapheneOS. I do have Play Services installed to be able to use Android Auto, and that required some fiddling with permissions before it started working, so your mileage may vary. By far the biggest annoyance for me is group text messages not being delivered while using an alternative user account, but that's a niche setup I guess.

I was also surprised by the banking app experience. After making me verify my identity about 10 times to prove I'm me and not a hacker, they finally let me use it...

I've heard some people had good results by going to their bank branch and demanding them to unblock their phone or they'll close their account. Apparently they have a checkbox to disable phone attestation requirements for a customer.

> Bank app developers have been surprisingly receptive to making the changes, weirdly enough

That's only weird if you live in a perpetual state of doomerism, or have bene influenced by those who are (youtube influencers, mostly)

Of course there was a simple explanation for banking apps not working the whole time. It's the doomers who turned it into a vast conspiracy with an all-powerful megacorp at the center.

You can check your specific app here: https://privsec.dev/posts/android/banking-applications-compa...

GrapheneOS has convinced apps to add compatibility. Hell, Roblox has official GrapheneOS support. The idea is to get more users in order to convince the very few apps that block GrapheneOS, to support it.

Probably not, because of Google attestation, the cancer of Android.

FWIW the financial institutions I use (all major US brokerages) have no issues with Google attestation, and if they implemented it I'd just move all my assets out to a different one.

I don't regularly use an actual bank account anymore, the cash management solutions from these brokerages work great and can do everything including direct deposit, payments, wire transfers, and ATM/debit cards, and have SIPC protection in place of FDIC.

vanguard? I have considered just closing my bank account and having my paycheck direct deposited there

Some banks are open (well as much as a financial institution can be) to GrapheneOS too. Navy Federal implemented attestation and then rolled it back once they heard from GOS users which was super cool of them and honestly unexpected.

If they have legal requirements for attestation, they also have the option to properly attest Graphene.

Yep. Not sure all of them are attesting GrapheneOS, but there's at least 5 banks officially supporting it.

https://github.com/PrivSec-dev/banking-apps-compat-report/is...

Everything in Sweden I've tried works.

My banks (in Europe) work fine. The primary thing that is missing is tap-to-pay because Google is abusing its monopoly position and not letting GrapheneOS pass remote attestation. There are some apps that have their own tap-to-pay, such as Curve in most of Europe and PayPal in Germany, but they don't work great everywhere (e.g. where I live, all payment terminals accept tap-to-pay based on debit cards, but more than 50% does not accept credit card-based tap-to-pay, so something like Curve or Garmin Pay doesn't work in many stores).

At any rate, there is a well-maintained list here: https://privsec.dev/posts/android/banking-applications-compa...

I didn't notice anything suggesting that Curve is "credit card-based" (from what I remember it was advertising debit in EMV). Curve worked for me everywhere in Poland, Czechia, Germany, Austria, Romania and Sweden.

Curve currently works great for me but I am hoping Walt will launch soon.

https://walt.is/

Deceptive marketing about privacy but it can't be worse than the other options.

Amongst the several banks I deal with, only one uses Google's attestation framework in a way that blocks GrapheneOS.

That said, the website still works fine for that one.

I imagine that banking apps will begin to have better support for GrapheneOS as it rises in popularity.

Reply on news.ycombinator.com