Comment by Arch-TK
5 days ago
Thanks, but no thanks?
I use GrapheneOS, but if you as a bank want to gate access to my money via some kind of technology, you better be including it as part of the account.
For example, HSBC continues to let me manage my bank account via the web browser, and continues to offer a battery powered hardware token as the means of authentication.
I let you hold my money, for whatever reason. Why do you expect me to be your distributed infrastructure provider? I am not going to let you require that I run your proprietary malware in order to access my own money.
The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.
I'd say that JS webapps are the same but at least there you run things on your terms in a sandbox that you can inspect and look at the requests, and there's no effective enclave carved out of your hardware (except for EME but that's another topic for another day and I'd be complaining if banks started to use it too).
You might be overthinking it. Most people want to use their phone for convenience, and if an app allows them to remove just one step in their banking activities, they'll probably do that.
As for the second part (separate authentication methods), sure, would be rather problematic if they require you to have a phone, but that's a completely separate and different issue.
Most people don't know they're also being taken advantage of. I'm mostly referring to data exfiltration.
Which isn’t legal in Europe and the UK. Get better consumer protection laws.
10 replies →
On GrapheneOS you can install your bank app in a different user profile, and run Google Play sandboxed, so this scenario of a bank app doesn't result in anyone having access to your other information.
6 replies →
What exactly are you referring to?
> As for the second part (separate authentication methods), sure, would be rather problematic if they require you to have a phone, but that's a completely separate and different issue.
It's getting somewhat annoying nowadays with banks pushing that crap, but fortunately legislation for access of people with disabilites forces them to provide tokens still.
A lot of them now switched to banking apps on the phone acting as token without a chance to opt out, though, so as a result I've stopped doing anything bank related on phones nowadays.
The app is also safe unlike the browser on your PC.
This is pretty extreme, it’s just an app for your convenience. I agree that web access should be provided too, but most people find apps more useful.
Do you not run apps at all?
I empathise with GP’s anger. “You hold my money” should be enough of a reason to do all in their power to build great web apps and support alternative OS’es.
I find that banking apps deserve that extra bit of anger pointed towards them. (It’s also increasingly hard to find an ATM in many countries. What are banks up to?)
> “You hold my money” should be enough
The thing is, people like GP don't seem to realize that holding their money is not much of an asset to these banks. Like, at all. Maybe no that interest rates are higher. But in general, you're not doing them any favor. My understanding is that holding retail money is a loss leader for most banks. Unless GP is ultra wealthy, they're not doing the bank any favors by giving them their savings or whatever.
4 replies →
> You hold my money” should be enough of a reason to do all in their power to build great web apps
Tell that to Vanguard or Fidelity. Two of the largest 'money holders' in existence, and probably the two worst financial apps I can think of.
In my case, the app offers functionality that isn't available on the web version. So I resentfully use the app, but I'd prefer all features were available via the web instead.
I’m with you, except that in this situation I resentfully forego the feature because I refuse to install apps.
Web banking means you need the card reader gadget as well for the authentication. The app uses secure features of the OS to aid authentication so you don't need to read the card. Web access on your phone still needs the card reader gadget.
6 replies →
meanwhile in my case the app offers functionality that isn't available on the web version while simultaneously requiring the web version for some of the things
What's more convenient than a permanent irreversible requirement that if I ever want to do any banking, I must use my phone or go to a physical branch (which are slowly all disappearing) to recover access. I can never just go back to _not_ using the app, I can only move the app to another phone. And the app restricts which apps I can have installed and even which developer settings I can enable.
The average banking app is not about convenience, it is about restricting how a user can access their account, compliance box ticking and an endless march towards minimising liability at all cost. Meanwhile people are getting mugged and moving money at knifepoint because the device they normally carry around everywhere with them is now a gateway to their bank account.
I only run apps that are open source, or that I can audit and that don't abuse Android's silly features to restrict me, and only when the app isn't a requirement to access or interact with something. For example I refuse to buy any hardware which requires a proprietary app to use a feature.
Move to the UK, none of your listed issues exist due to open-banking [1] (or, at least I’ve never personally encountered any of those issues with any of the four bank accounts I have).
[1] https://www.openbanking.org.uk/
> Do you not run apps at all?
No, I don't want to run any apps, particularly commercial ones. I only run a few FOSS apps like K9, IronFox, Signal, Home Assistant.
I have, on occasion, downloaded and tested apps from the Play Store in a separate profile, and my experience of such apps has been extremely negative. Clearly, these apps don't exist for the user's benefit, and their purpose is to extract information about the user, including phone number, location, other apps used, contacts, etc.
I get that you'd want to protect you data, but that list is a bit weird. The phone number is rarely available to the apps today - you need to provide it yourself typically (SIM feature rather than Android thing), location can be denied, contacts can be denied, listing other apps requires a permission that very few apps are allowed to carry. Typically apps cannot do any of what you listed without explicit approval and it's definitely true for the legit ones.
> it’s just an app for your convenience
How often do you think companies are in the habit of doing things for your convenience?
Not who you replied to, but requiring me to install your app or create an account is usually going to mean I skip your thing unless I'm really motivated (or forced basically) to use it.
Well, their competitive advantage too, but they don’t have to be mutually exclusive
I will do what I can to avoid using apps.
I daily drive an app inside of an advertisement inside of a mini app inside of an everything app. Its terrible but there is no escape… unless you quit ordering coffee (which I just did)
4 replies →
I use a terrible investment platform that purposefully nerfs the web app so you are forced to use the mobile app.
For something like a bank, I think they ought to be mandated to offer a functional website, yes. A slick app is nice too, but not if it’s the only option, specifically designed to steal my data and spy on me.
HSBC pressure you into using the app and I don't think there is a way back to the battery powered OTP device. At least not that I know in the UK. I resisted until the battery failed and they basically make you go into the branch and then plead why you can't use a smartphone. got sick of this dance after 3 years
That their app wouldn't run on my phone "wasn't a valid reason" to not use it, they said. Luckily, it is a charitable/community account and an organisational rule prohibiting officers from having bank apps on their personal phones was accepted - for now.
They seriously said something like this to you? The last time I had to interact with them to get a replacement hardware token was about 6 years ago.
So is it now their official policy that to have a bank account with them you must own a phone that can run their app?
I really don't get how your excuse worked, but I am guessing this is a made up policy and the fact it's a charity made them think twice about being assholes about this.
1 reply →
I got a replacement widget recently, the website pushes the app but when I asked in branch they gave me one without even asking my name. I had to wait on the phone to register the new serial number, maybe I could've done that in person too, but it lasted years (and multiple phones) so I don't mind too much
The magic words that work at most banks are "close my account", but you have to be prepared to actually close your account if they don't back down.
Maybe that works in the some countries, but among the 3-4 mainstream banks in my country, making that threat when you are anything less than an unusually high earner by local standards (and perhaps a customer of ancillary investment services) is just going to be met with "Fine, we'll close it then." You might be overestimating just how much banks need any one average person's custom. Also, by local cultural standards, making such threats to a business for the sake of obtaining better customer service is over-the-top Karen behavior, so you have already lost when you do that.
27 replies →
This probably won't help you in the UK, but for those in the US, Wells Fargo uses an optional RSA SecurID Device.
https://www.wellsfargo.com/biz/online-banking/securid/
Most of those devices are interchangeable, so if you have one from NatWest, Barclays etc it will probably work with your card. It's also possible to replaec the battery on most of them.
The one I got from Lloyds has a replaceable battery
hsbc app is also in the group that forces you to disable all keyboard apps (even Futo), and used only gboard or samsung.
> I am not going to let you require that I run your proprietary malware in order to access my own money.
Why do they need to tailor to you how they do business? They could cut you off from accessing your money over the internet entirely if they wanted. They don't even have to offer a debit card, it could be a bank where you can only deposit and withdraw cash in-person.
My point is that you choose the institution you want to bank with based on what they offer and if it works for you. Banking is the poster child for an industry where people switch institutions based on what the institution offers.
> The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.
Corporations offer services for money only under very narrow requirements and conditions because relaxed requirements would cost them money overall. If people are expected to provide free compute, and 99.9999999% of your customer base is okay providing that free compute*, then they'll go that route.
*: The actual cost to run any given javascript or web app is probably less than a penny, even if you add the actual energy cost to do so plus amortize the hardware cost over the lifetime of your hardware
> Why do they need to tailor to you how they do business?
Exactly, VCRs should be banned -- why should cable companies tailor to you how they do business, and be forced to allow you to plug in anything into their distribution network? Only approved TVs should be an option.
I mean, I wouldn't be surprised if Walmart's Onn brand had the audacity to release a port-less smart TV and discount it even more since that would be guaranteed data collection / ad sales.
Hopefully people are educated about that fact before they purchase said TV, though.
In the UK, you _must_ have a bank account if you want to exist. I can't pay my mortgage in cash, and I can't take a salary in cash. So while I can _choose_ a bank, if there is no law literally preventing them from all requiring a smartphone to manage your money, then I imagine at some point that will happen, and then what do I do? Move to a different country?
https://walt.is/
Wow - I really want that to succeed!
I've heard that an NFC alternative to ApplePay & Google{Pay|Wallet} is Curve Pay, but sadly it requires KYC (while the former ones don't). Do you know if Walt will require KYC too? It's not clear from their website.
If I remember correctly in their newsletter they mentioned that they will, as it was unavoidable. But I'm talking from memory, that email is long gone from my inbox.
the problem I had with Curve is that this privacy policy is a bit trash, and their DPO was unresponsive when I tried to exercise some of my GDPR rights
I like the idea but it has some pretty suspect TrustPilot reviews, and its connection to crypto is a bit of a red flag to me.
That is not the same Walt. I'm assuming you found the TrustPilot site for https://walt.io, which is some Telegram crypto thing from the US. What GP linked to is an independent wallet app that currently supports passes and is scheduled to support tap-to-pay in the near future.
My way of thinking is that if I can only manage my money through your app, I'm not givig you my money
> I am not going to let you require that I run your proprietary malware
This is likely meant as hyperbole, but South Korea's online banking requirements really tries to live up to this reputation
My fiancée who _does_ have the HSBC app has had to choose between enabling accelerated animations in the android developer settings and being able to access her bank account.
I think the HSBC app qualifies as malware but I'm morbidly curious how bad South Korea's version is...
Yeah, putting up HSBC as some bastion of great experience is an odd choice. Their web UI is straight out of the early 2000s, complete with odd little redirects to even crustier even older web portals for doing certain operations. And their app is pretty garbage as well.
My bank pestered me so much to use their app that I eventually caved in. Ironically, they claim it's more secure than normal internet banking from the PC with 2-factor authorization, even though they send the SMS token for in-app transfers to the same phone as the app...it makes no sense.
Assuming your phone cannot be trivially unlocked by a thief, it likely is safer to bank on it than on a computer.
Because unless your desktop is dedicated to banking, there's always the chance that one of your other activities will install malware. If you don't use FDE (the majority of people) and you saved your banking password in the browser rather than a password manager (likely a scary amount of people), then theft is also an issue.
Neither of those things are really a problem on a mobile device.
The banking app _is_ the malware. It interferes with the normal use of your mobile device. For example, you can't use developer options to speed up the UI animation speed if you want to access your bank account. You can't install any app you want if you want to access your bank account. etc...
The EU two years ago rolled back all their proper OTP 2nd factor logins and now exclusively allow their EU app otp or sms
it's so obvious they need backdoor access it's not even funny.
Who is "they", and what do you mean by "backdoor access" to your bank account?
1 reply →
Right... and let's just hope those banks pushing the app-everything culture with semi-working web interfaces still online don't start requiring unauditable WASM binaries to run them.
JS webapps have one key feature in this respect, there's no possibility for banks to force particular OS/HW on you via attestation.
Passkeys come with device attestation.
Optionally. And passkeys attestation only covers the HW key for example, not the OS running the website or the website. You're still completely free to re-implement it your way + FIDO2 is a standard, so eg. if you want to write your own native app for the bank web API, or whatever else, you can and passkey attestation will not stop you.
Android app/os attestation on the other side is a complete lockdown that prevents you from creating your own apps on top of server side apis the original mobile apps use.
So get them to remove support for device attestation from the spec, or don't use passkeys.
I rather travel by horse down to my local bank to get my money than to use HSBC to do any sort of banking.
Most banks will have a second option to stop you from closing your account with them, but it's hidden.
>Why do you expect me to be your distributed infrastructure provider?
...You realize that we're talking about banks, right? Institutions operating on a fractional reserve? Take your money, use it as collateral to print 10x their holdings in interest-bearing debt? Free to restrict your withdrawals and bail-in funds from your account to save their own hides? Those banks.
The Occupy Wall Street and Bitcoin dudes and dudettes had it right, which is why they were carefully marginalized and appropriated, respectively.
The bitcoin dudes and dudettes didn't understand how the same incentives that apply to fiat money also apply to bitcoin.
If you have Bitcoin in a self-custody wallet, is there a bank corporation to "restrict your withdrawals and bail-in funds from your account to save their own hides"?
Maybe naive on my part, but from a security pov I trust my bank's app more than the browser on my pc.
"Let you hold my money"? In what society is that true? Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank. They have an immense amount of power and operate in a heavily regulated area so there's guaranteed to be very little competition.
Voting with your wallet does not work here. There is only a handful of banks, and in many (most?) countries they all force proprietary software and/or unreasonable contracts on their customers, switching between them does not help.
> Banks run our financial infrastructure, and you can't just opt out of them. If you want to have a salary, do your taxes, or raise children you will need a bank.
After getting screwed around by my bank (ASB) I am looking to get away from them. Wise is tempting. They are not a bank.
My salary can go to them. Why would I need a bank for taxes or my children?
The only thing holding me back is the fact that money isn’t government guaranteed as secure with them. With ASB NZ$100k is government guaranteed.
Google tells me there are about 4.3k FDIC insured banks that operate in the US.
At what number would you consider this to be more than "very little competition"?
I have lived in several European countries but not in the US. Maybe it is different there. The only clue in the post was HSBC, which is a British bank. This is why discussing this is so hard.
The European Union has tried to create a pan-European banking market for a long time without success. Banks are still a national business, even if banks themselves operate internationally you always do business with their local prescence. In theory you could keep your accounts in another country, in practice that is a massive headache.