Comment by grapheneos
5 days ago
EU regulations require banks to require confirmation in an app with device and app integrity verification. They don't specify what that means but they have to do it. SMS 2FA is temporarily allowed for the transition period.
Apps are not required to use the Play Integrity API or a similar attestation API. The details of what they're required to do are unspecified and open ended. Many are interpreting it as meaning they use the Play Integrity API and we have to convince each one to permit GrapheneOS via the Android attestation API. It's not good and we would greatly prefer if this wasn't happening even if we were managing to convince most apps to permit GrapheneOS.
I'm don't see "allow GrapheneOS" as a great difference: the bank is still only permitting transactions on devices controlled by a third party and not by the owner. I don't want to change the third party that controls the device. I want to use my own device.