Hacker News Reader

Comment by ciferkey | Hacker News Reader

This site tracks the status of what apps work: https://privsec.dev/posts/android/banking-applications-compa...

The official GrapheneOS docs contains a developer guide on how to fix banking apps when they are not working. Bank app developers have been surprisingly receptive to making the changes, weirdly enough. You can see in some of the issues tracked on the site where people reached out and the developers eventually made the apps work.

I've been running GrapheneOS for a while (I have posts on the blog in my bio if you want to see some day-to-day info) and only one bank app gave me trouble. I had to toggle a setting and then everything worked.

Separate from this is wallet and payment apps which still have not had much traction on GrapheneOS.

View on HN

I was also surprised by the banking app experience. After making me verify my identity about 10 times to prove I'm me and not a hacker, they finally let me use it...

I've heard some people had good results by going to their bank branch and demanding them to unblock their phone or they'll close their account. Apparently they have a checkbox to disable phone attestation requirements for a customer.

Heh. USA user here. Several of the apps that say they work I have been unable to get to work.

So anyone reading this, be aware your experience may differ.

I'm on a pixel 10 pro and have never been able to get some of banking apps to work, despite the list saying they should.

It is likely a crapshoot, and while that list is informative it is necessarily a snapshot in time. FWIW, my banking apps have worked with no issues and have worked continuously since I migrated to GrapheneOS. I do have Play Services installed to be able to use Android Auto, and that required some fiddling with permissions before it started working, so your mileage may vary. By far the biggest annoyance for me is group text messages not being delivered while using an alternative user account, but that's a niche setup I guess.

> Separate from this is wallet and payment apps which still have not had much traction on GrapheneOS.

Curve works in Europe and Paypal has a trial thing in Germany for tap to pay IIRC. There's nothing in the US unfortunately, yet.

If you want more security and privacy, don't use your phone for payment - use your card.

I don't know if that's really significant. But yeah technically you give up less information by using the card directly instead. But it's like going from 98% privacy loss to 99%.

Cash and Monero are private so they're in a different space and are what should be prioritized.

It's more difference than you think. Your card isn't logged into Google, Facebook, Signal and so on. It doesn't route through Cloudflare. It doesn't even connect to T-Mobile, Verizon, or Stingray automatically.

> It doesn't route through Cloudflare. It doesn't even connect to T-Mobile, Verizon, or Stingray automatically.

I fail to see how that's significant at the banking level. What does Stingray mean in this context??? Signal??? It's just a messaging app. You can use a VPN or Tor.

Your purchases still go through all these routes on the payment processors side. And you can use Apple pay offline–it's just NFC.

You realize ever card purchase (when where what how much) is logged and stored for like 5+ years (probably forever). Yeah I'd probably prefer not to add Google to the mix but your carrier only sees DNS logs not the encrypted content.

If you want any privacy whatsoever in payments use Monero and Cash: https://eylenburg.github.io/payments.htm

Only two parties who are legally forbidden from sharing have those logs instead of 10 who aren't

> Bank app developers have been surprisingly receptive to making the changes, weirdly enough

That's only weird if you live in a perpetual state of doomerism, or have bene influenced by those who are (youtube influencers, mostly)

Of course there was a simple explanation for banking apps not working the whole time. It's the doomers who turned it into a vast conspiracy with an all-powerful megacorp at the center.

Reply on news.ycombinator.com