Comment by ACCount39
1 day ago
SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
> if a major regulator like EU steps in
Even if they did, I feel the result will be the opposite of what you expect. EU own reference implementation of eID relies upon Play Integrity [0].
[0]: https://github.com/eu-digital-identity-wallet/eudi-app-andro...
Google Play Integrity check
(otherwise it wasn't clear what 'Play' was referring to, could have been some EU thing)
We should force some executives to enable their kids to play rublox on a non play integrity device.
That would solve the issue rather quickly.
Don't think this would work as well as you think it would. One of the privileges of being an executive is that you basically have unlimited access to money so their kids are playing roblox on ipads (each kid has their own).
5 replies →
Oh, the horror! The digital pacifier does not work on this weird cheap phone
Normies don't understand the that any computer should be able to run software from any other computer. They dont get the idea of the general purpose computer. They've bought into the idea of computers-as-appliances sold by steve jobs and others.
The executives you're talking about don't see an issue with this. Their solution for this is the same as everything else: spend more money and buy another device. User freedom does not even enter the equation.
5 replies →
They are doing the same with Wero.
I believe the fit is so poor that google should really object to it. I already refuse to make youtube videos because I need my gmail account.[1] If I need my google account for my ID and my payments I cant use gmail.[2] I also don't need Google ads badly enough.
It doesn't take a lot of stupid to lose the account but ANY account activity at all may trigger false positives.
In theory the US government can seize EU google accounts. Given time I'm sure we can find even crazier rulers than Ursula and Donald combined.
[1] - I got one flag for a 10 min video including 10 sec of 1991 footage from a local NZ news agency credited both in the video and linked in the description.
[2] - I've already lost my account once temporarily for jokingly hitting reply-all without looking how many cc's there were.
> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.
There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.
Whilst not PSD2/PSD3, I've been super happy with Wise; an excellent API, good quality docs. A _proper_ test environment that you can drive using hooks they expose. Nothing but praise for them, including their support, which has helped me around the clock even on weird questions such as why my custom integration fails to send a transaction (mismatched currency between recipient and transfer in my code).
Not going to be a good day when Wise or Plaid are breached and accounts start being drained. Adding middlemen is not a solution to poor banking services.
Wise is not a bank, is not licensed as a bank, and is thus not insured like a bank is.
Balances are held in Wise at your own risk.
1 reply →
Because these API are not meant to be public for the end user to use.
Access to that kind of data requires regulation, a lot of it and that's why Third Party Providers exist. There are a lot of them in Europe and they're not expensive.
I actually didn't expect to find anything about bunq around here but I have to say they're the worst bank I've worked with. When we started working with them, their API were broken and the devs had no idea why. It seems to have improved recently but it's definitely not a bank to praise for their API.
Bunq… It’s great that they have an API, but to use it, I had to clone their SDK, and manually fix everything that was broken, add some workarounds, and now it works. Documentation was all from the announcement in 2016, me using it was ~2022, and some undocumented things changed since. Still, better than no API, which is what everyone else seems to offer.
And now we have a paypal-like shopping experience via SEPA Instant Payments, all our PayPal hating customers are happy ;)
> Because these API are not meant to be public for the end user to use.
I know, that's my point. It's a stupid decision.
> Access to that kind of data requires regulation
It's my data. I want to access it how I see fit.
> There are a lot of them in Europe and they're not expensive.
I already have a bank and I already pay them. I don't want to pay anyone else to be able to use my bank account in a way that suits me. Sadly, there aren't many good options.
Someone mentioned Wise, and they do seem pretty interesting. But it makes no sense why common high strees banks refuse to cater to power users, or even to users who aren't using mainstream devices.
8 replies →
It's Open for other (similarly regulated) institutions, not open for individual persons.
I've actually been very successful in building a Home Assistant integration for my bank, built on PSD2. Approval took 4 days, after that I had production access. It's not that bad. Obviously you get Design By Committee problems, but better than no API.
In the UK, you do require an FCA registration to access Open Banking APIs, but I built an open-source client (in production) that handles a lot of the API integration work: https://github.com/finlabsuk/open-banking-connector
In Hungary you don't get documentation for these APIs only in pdfs via email, and if you get it the APIs are not stable, constantly breaking. I was always dreaming about creating an automated testing suite and report all of the issues automatically to the national bank, which is the supervisor of all commercial banks in HU, in a hope to punish them.
>I was always dreaming about creating an automated testing suite and report all of the issues automatically to the national bank, which is the supervisor of all commercial banks in HU, in a hope to punish them.
Vágj bele!!
You guys get APIs??
Seriously, count your blessings man. In America we only get Plaid, which only works right or reliably for big banks (which are also the worst ones), and it isn’t an API for humans, just a paid SaaS product that a company who wants to offer integration with banks has to pay (i assume a lot) for.
1 reply →
> "Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful
You mean the step from sandbox to production application, or you're not even getting access to the sandbox itself? I managed to get sandbox access with ease via two separate banks (both Spanish though), with no problems, think it took them one (working) day or something to review my "application". I never tried to get anything into the production environments though, but makes sense they'd be a bit tighter on that tbh.
Not sure why you'd claim it's impossible, it's in wide use already by banks, fintech and payment service providers across the union.
I should have added that it's impossible for individuals, not for fintech providers.
1 reply →
Remember Bitcoin?
Why would banks be motivated to care? People just give them money as a business model. Up until recently, Wells Fargo didnt have case sensitive passwords even, because no pressure to do anything about that.
To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.
>> People just give them money as a business model.
You dont actually give them money...you loan them money when you do a deposit. That is why they pay you interest, and that comes with the risk of loans to another party.
A little detail they are happy to omit and they are happy to let people talk about: "I have money in the bank", that you of course ...dont have.
At least in the US most banks are FDIC insured so your first $250k or so in deposits are secured by the government.
There's no real risk involved.
9 replies →
The interest rate banks pay you has been 0% since before covid
14 replies →
isnt it the opposite in parts of the EU? you pay interest on the deposit
I don’t know of any bank that hides the fact they lend out money. Most pretty actively advertise it.
6 replies →
Well, you're probably going to be very disappointed when you learn how money works in general these days.
Hint: Gold has no more to do with it than any other commodity does. Ditto with petroleum.
> Why would banks be motivated to care?
Because courts have made them pay the curtomer their losses when the customer (not the bank) was scammed/hacked/etc.
And you don't think that plays some part in all these arcane security requirements that basically amount to "you're doing something a little weird so we're just going to block you rather than support it"?
> Why would banks be motivated to care?
Unfortunately, banks can be held liable for customers getting scammed. Even if they win in the end, they have to make the customer whole first no matter what [1].
[1] https://www.tagesschau.de/wirtschaft/verbraucher/eugh-konto-...
They are breaking the law, that should be motivation enough. That the number of non android non ios users is small shouldn't be relevant. The locked down android and apple devices are like virtual US soil. The obligation should be to service all EU citizens rather than a sub set.
Banks are motivated to care, but in the direction they currently do. They can be on the hook for making up losses. Whether you as an ultra leet hax0r can run rooted/jailbroken devices without getting owned, they are worried about your non-leet parents doing the same and having their retirement accounts drained by North Korea. I know it sounds far fetched, but it is a plausible scenario that I heard recently
The same banks that typically embrace the 3 biggest signs of security stupidity:
- max length of passwords (not talking about lengths that would pose a DoS threat, talking limits like 20 characters)
- incredibly constrained character set for passwords (“your password can’t contain a quotation mark, only alphanumeric and these specific 10 punctuation marks”)
- “security” questions (can we just ban these already? Knowing that my childhood dog’s name was Bingo should NOT give you the ability to change my brokerage password.)
Then eMudhra happens and all that security theatre goes down the drain as you (as a device owner) are not allowed to even disable a pre-installed "trusted" CA. And then you can also run a old, vulnerable device with a "signed" OS and SafetyNet will happily allow you to run such apps.
It wansn't a mistake, it was a deliberate attack on the user, i.e. malware.
I'm convinced the Amazon Fire Phone was the motivation for SafetyNet.
The Fire Phone was a midrange Android phone from 2014 preloaded with Amazon's app store and services instead of Google's. It failed on its own merits, but I think Google got scared someone else would do a better job. The barrier to entry is a lot higher if most people can't use their banking app on it.
More it was the banks were made liable for stolen funds. So they responded by making funds harder to steal.
Do you really think banks care about you installing custom themes or whatever? They only care because the cracked Spotify app also has malware bundled on the side which uses the new root access to break the app sandboxes.
It is both.
I also consider restrictions against open source to be malicious acts - hence also malware, such as by banks and other companies. Or, worse, government agencies. In a local medical university in central Europe, for instance, we are required to either have a Google account or a Microsoft account - usually the latter, to access emails.
All paid by the taxpayers ...
[flagged]
I don't know if there is a common API standard from a technical point of view, but there is the legal framework for it. Banks in the the EU have to provide an access to third parties who provide account information services to clients (themselves being regulated and supervised by a national agency). I would assume because it is mandatory, it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.
> it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.
it would be if wasn't for the obvious reasons of those being banks
Mostly the government forces them to do this. If the capability did not exist it wouldn't be mandated or used. Think about this whenever someone tells you "just don't use it if you don't like it", about everything.
There is something really tragic here.
EU has PSD2 which enforce good, strong rules on customer authentication. For example, banks must have two-factor authentication. And if both factors live on the same phone, the bank has to safeguard against that phone being compromised. Hence the root detection and app-integrity checks that he is complaining about.
But what's tragic is that instead of understanding the problem, which is partly driven by regulation and mostly not even a problem, he calls for more government regulation. What a mess.
This makes sense. It's not a second factor if all elements live on a possibly compromised device.
> But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.
Same reason why media companies spend millions on DRM that delays the pirates by 0 days. Checklist-driven "security", CYA and out of touch executives calling the shots.
Did the higher ups want more effort to be spent on "security"? Yes. Is there any way to actually add "more security" to the setup? No. Could not doing anything in face of direct orders from the above be bad for your career? Yes. So random bullshit go.
It's not like the bank client developers are even implementing any of it themselves. They buy someone else's middleware and hopefully don't misconfigure it when they cram it into their builds.
Because the bank takes liability if money is taken from your account without your permission.
in order to minimize chances of someone stealing 6 billion out of them that's why
The issue is weird. Banking is both conservative and on the lookout for new way to make things complicated, but one dumb executive --usually-- can't derail the entire bank, because there are enough stops in place. This is one of the reasons US banking is such a ridiculous mix of various integrations of a line of executive decisions resulting indirectly from lunches with said executives.
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which always include all of the user hostile bullshit you mentioned.
It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/
The only way this can NOT happen is if someone quite senior signs off on the risk, who would have to get in a big fight with the cyber/policy teams for basically no benefit to themselves. They would also have to be unusually technical and pro freedom to even understand the issues, which is not the typical personality profile of the kind of executive who ends up with overall risk authority for a bank's mobile app.
I once was dragged into a meeting after a security audit where the audit flagged in red that we weren't encrypting a SQLite database.
I basically said it was bullshit, pointed out that this was not industry best practice, and that we weren't storing any sensitive information.
The meeting ended quickly (and it became clear that the auditors were full of hot air.)
yeah, there are a lot of bad auditors in all kinds of ways, mostly:
- auditors which commonly "pass" things which should be flagged, but happen to be a more expensive then normal industry standard in ways which should make them non-competive but somehow they get hired a lot
- auditors which flag nonsense and don't understand anything about security at all
some of the "security frameworks" which are applied by default makes a lot assumptions about how software is build/structured/works _based on what was common in the 90th_, and they don't even list their own assumptions... Luckily they are a base line you can perfectly fulfill but still a pain.
Like e.g. a session key having 128bit entropy is a reasonable minimum, but then imagine the framework assumes the session key & session id are the same because some 90th software did so and now requires you session ids to have 128bit entropy, but e.g. UUIDv4 has only 122bit entropy and a UUID being used is deeply integrated into middle-ware you use and can't be changed... (And having a session id=session key setup is anyway a bad idea as it means you mustn't log the session id anymore, but you also might have requirements which do require logging session ids in audit logs and similar).
This isn't even the most nonsensical thing I had ran into, just one I remember well. There where rules based on assumptions of you uploading files into a file system _using the upload file name_ while interleaving security sensitive web-server config files with uploaded directories ... like yes I know some software did so in the past but the rule should be "your software musn't do such a negligent thing" and not "you software must do this 5 extra steps in case it maybe does that insane negligent thing"
Instead of asking the government to fit all banks' products to your preferences, you could just use a bank that fits your preferences.
I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).
> you could just use a bank that fits your preferences.
you assume this exists / can exist
(for a given set of reasonable requirements which aren't yours)
but various "practices" and "regulations" for software security push banks into the direction of such nonsense, so if a major reasons this is happening is the government asking them to fix it is very reasonable
similar in other context where that argument is often used you have problems like monopolies, collusive agreements or various source pushing companies into acting collectively user hostile weather it's laws or other reasons
the government fixing such things by changing laws/regulations is pretty much the only things which can work in many cases
this doesn't mean they have to tell companies exactly what to do, instead they (should) find out what pushes things in bad directions and then "counter balance it" in some form or way
You can do both
> banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it"
Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.
Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.
> forces banks to provide access through a common API standard
Doesn't PSD2 already provide this?
I think this is good actually. We have taken the convenience vs security trade off too much towards the former either because or due to how busy and intense life is nowadays. Waiting 4hr to make a big purchase should almost never be a problem.
No, the banking system just runs so perennially behind the times that they suffer from baroque issues that no one else has had in 20 years.
Eg the above example; how is it possible to send money without knowing who the other side is? I can trivially look up a domain name and see registration info, I can look up the IP to see who it’s registered to, I can check certs to see if they’re valid and legit.
It’s bizarre how normal we think it is to send large sums to random strings of digits that we think are Amazon or the IRS with basically 0 way to validate them.
I bought a house in cash and putting the money in escrow was unbelievably stressful. They send me numbers, on a printout that’s a scan of a scan of a scan with text that says “call to make sure this is still the right account number”, and a bajillion warnings to make sure the number is right or vague and terrible things might happen.
Insanity that I can get insanely complicated gadgets shipped to my house in 4 hours but we don’t have a better way to move 6 figure sums than “double check your numbers”.
1 reply →
That seems like a big regression versus a paper check. With a check I can “spend” the money immediately, or at least commit to spending it. It isn’t deducted until the check clears (which is a pain) but I don’t have to wait around for 4 hours apologizing to the seller until I’m allowed to transfer my own money.
This reads like you’ve never made a large purchase outside of the internet. I don’t know why you’d advocate for this except to be contrarian.
I recently had a family member with a medical emergency in a foreign country with only 1 direct flight to cross an ocean, and there was a narrow window of time to buy the very limited supply of lie flat seats needed to make the trip so medical care could be resumed as quickly as possible.
It was nice to be able to spend $30k+ on short notice. With modern security features, there is no need to enforce an arbitrary time limit if the payer accepts the risks.
1 reply →
This is mostly why I stopped messing around with rooted Android and GrapheneOS. I like using banking apps (mostly for transfers at shared meals) and have no desire to carry two phones.
> By now
Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
The USA read that quote and said to itself, finally, an ideological system we can get behind!
My previous bank app (HSBC) detected that I'd jailbroken my iPhone, and warned me, but allowed me to continue at my own risk, which I appreciated
Sounds like Open banking
Which is not very open, it just means it's open to other companies. If I want my own data there is no api for me.
There is bunq, which offers a full API for regular users, including a web hook call in case of new transactions. Made me actually switch to them. Super nice so far.
https://doc.bunq.com/
Exactly, it's an utterly ludicrous state of affairs that I'd have to give access to a third party to my freaking bank details. And this is treated as some kind of success?
One of my agents has (read only) access to my accounts. I do it via Era, which is quite good, though expensive (they try to justify this with other functionality, but they provide nothing my agent can't do itself other than the API access).
To provide me with API access to my own accounts, Era goes through another third party provider which again connects to my bank. I guess they could eventually get direct connections themselves.
So instead of me get convenient read-only access to my bank, I've ended up giving two separate third party providers credentials I'd prefer they didn't have.
All I'd need was an automated way to get a CSV or JSON dump of my transactions and I'd have been happy, but none of my banks support that without manually logging in. It's infuriating.
Open banking isn’t mandatory. Psd2 and successors are. But it does not require the banks to expose feature parity APIs so others can replicate their apps.
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
But that is quite limited.
A lot of apps belonging to Indian banks will simply refuse to open if you have developer options or USB debugging enabled. Fun!
I'd really love to see your banking app that works differently and cannot super trivially be attacked by malicious software. Can you show us your example of such an app? It might be helpful to show tha validity of your arguments.
> By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
You mean like HTTPS? It's a shame that mobile banking website have fallen out of favor.
If there wasn't SafetyNet it'd be something else, probably per OEM like Knox which would be worst.
People need to stop calling for the EU "to step in", they already have and made everything worse. They forced PSD2 with """"""""""""""Open Banking""""""""""""""" which requires convoluted requirements and is regulated to death so no private person can call the API themselves and get e.g. their balance or transactions.
I like complaining about it too, but it's still a massive step forward from how things were before, where I had no access. Now I at least have access even if it involves going via third parties.
How is that worse? It's only "open" in the sense that other licensed businesses can provide services that integrate with your bank account, but it didn't take anything away.
The worst part is: you can't escape them.
You need to have a bank account to live a life outside the woods.
I have multiple bank accounts, because I am a solopreneur, yet all of them are weird in their own ways
Check out XS2A.
I saw my bank embedding a keylogger and it was even scrapping the password entered to login and basically slurping everything done on the page to an external domain. I checked with the bank and they said these were their analytics and nothing to worry...
I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.
the alternative is letting binance give your money to north koreans.
It's a very difficult set of choices.
I'm not saying that crypto currencies are the solution to everything wrong with the banking system, but if you have crypto at Binance you do in fact not own any crypto at all and are literally using them as a bank, just an unregulated one. You get the worst of both worlds.
When you actually own your crypto currencies because you have the keys Binance cannot give away your money to North Koreans.
Much better - enforce that every bank that has app has a website and feature parity between both.
And that the website is fully usable by any W3C-compliant browswer.
And that common API would require safety net too. Banks and the government are the same thing: the enemy of of free computing.
SafetyNet indeed was and it was not a mistake. Mistakes are bugs, a company doing things they didn't want to do, or didn't intend to have the effect it later had.
Banks on the other hand, as much as hateable (most of them are), also just shit bricks at mere thought of one regulatory spanking, not only hammering from their boards and shareholders (esp. the major ones). So – it might be a great idea to not shit on banks shitting on such choices.
Banks are also sacred of making changes and going farther from the "mainstream" and another reason is also because - they handle "real money", often people's entire life-savings.
We just think:
… oh, this OS is soo cool, so safe, let's use this.
… And then notice: goodness, this motherfucking company is not letting me use their app on this coolest and safest shit out there. Burn them!
And banks think:
… shit this one is not part of any common industry standards, let's stay the fuck away from it.
… Further: ha, authorities don't look kindly on this OS, let's stay extra away from it.
… And more: will this mean we have to support one more standard, one more release channel, one more modified OS? Anyone who mentions name of this OS again will thrown out of the window of highest floor of our HQ (and mind it, we are on 33rd already).
Solution (one of the) is forcing Googles and Apples to stay open, to stay respectful of user privacy in an absolute and transparent manner, to not let them implement closed-off protocols, to have APIs that is not availalbe to everyone – in a safe manner, not let them (and the politicians and security agencies) fear-monger the public like "think of the children" etc. Blaming banks is literally barking up the wrong tree – esp. in this context.
Another way is: not buying these devices and suffer the pain (and experience the bliss, yes!) and then hope/work for this number to increase and collectively point a thick and long shimmering hot rod (metamorphically speaking) at the hinds of such companies (hell, include the banks as well – so that they won't fuck up their desktop and mobile portals) so that they collectively feel the heat and are forced to bend (no metaphors here!). But no, we won't let go of our annual pleasure of this practically bullshit <First Time on an X>™ orgasms.
tl;dr: SafetyNet was not a mistake, making something like SafetyNet into the monster it and then making it limited to one company/one publisher (esp. since they are the ones who also control the OS) was the mistake. I think of this to be solveable sometnhing on the lines of multiple certificate issuers (but we have to be careful of eMudhras) - both for safetynets, and app stores (if not combined).
Safetynet was not a mistake; it was a lock-in mechanism. Widespread failure to call it out as such and oppose it as happened when Microsoft proposed something similar for PCs a decade earlier[0] was the mistake.
> will this mean we have to support one more standard, one more release channel, one more modified OS?
Android apps don't have to take any active steps to support third-party distributions. All they have to do is refrain from taking active stops to block them, but I suspect you knew that.
[0] https://www.nytimes.com/2003/06/30/business/technology-a-saf...
> 120MB APKs full of obfuscated code
Wow, where'd you find a bank with a mobile app that lean? Please share for everybody's benefit! /s
Half a gigabyte of app bundles is unfortunately no longer an outlier...
EU wants to have as much surveillance as possible, that's their only interest.
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Not any more.
Most European banks either don't have a web banking at all, or require a mobile app to log into it. There are exceptions but they are rare and becoming even rarer.
In Thailand pretty much all of the banks are shutting down their websites. App only, typically requiring visiting a branch to register the app on your phone, blocking screenshots, and often blocking vpn or 1.1.1.1 access. :-(
2 replies →
That's good time to switch.
> it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Not all banks. Monzo doesn't have banking through the website, and I doubt they're the only ones.
I just looked and apparently they do have a user API. It looks like it covers a lot of the functionality of the app.
https://docs.monzo.com/#introduction
That's true for personal accounts. Monzo business accounts can be managed through their website (with authentication via mobile device).
Well that's not really true. There's most definitely functionality that is only available in the app. If I want to make a payment without having to dig a card reader out every single time, I absolutely have to use my bank's app.
> "Well that's not really true. There's most definitely functionality that is only available in the app. If I want to make a payment without having to dig a card reader out every single time, I absolutely have to use my bank's app."
Maybe not for you, but you don't know his bank. Obviously I can't pay with my phone if I sit at my computer and use online banking in browser, so obviously payment with phone app won't work if I use browser on phone, for all other online banking functionality there is no benefit in the app, all of my 3 banks I regularly use don't require any card reader or even smartphone, all I need is any phone being able to receive SMS with 2FA codes, if my bank required app to use online banking I would just stop using their services. I am not going to bother with app in the phone while sitting at computer with 32" display and proper keyboard.
1 reply →
So you have to use the other option if you can't be motivated to use the first option? Seems more damning on you than the bank...
My bank doesn't have a website I can log into.
Sounds like you know what to do, then.
1 reply →
You need an app to login to the website. Then they say nobody uses the website
But not with a VPN. Hackers might use a VPN.
Still false.
As a rule of thumb that's a false (obsolete) statement.
I've used smile since 2004. It has an app which is fine, or I use the webpage which has more choice. I used HSBC before then which had a web interface, I vaguely remember natwest had special software for computer banking in the 90s, that might have been business accounts only, and potentially even was dialing direct to their systems rather than via the internet.
There are app only banks, you make your choice and you pay your price.
Nah SafetyNet offloaded a huge chunk of security on Android from app makers to Google/AOSP, it's an excellent system that works great for 99.99% of uses. It's what allows safe and fast banking on Android in general.
I'm skeptical.
An immutable OS install and app sandboxing by default provide a lot of security. Those are present on third-party Android distributions that don't pass SafetyNet. Some users of those add root access so they can let a handful of apps out of the sandbox, but I'm willing to bet most of those are tech experts with better security habits than the average person.
Show me examples of actual data breaches and account takeovers SafetyNet would have stopped if you really want to defend this position.
It's an excellent system that forbids up-to-date open source systems, but is completely ok with systems that are several years behind in security patches.
It's just a way for app makers to point their finger at someone else.
It's a system that allows even those old systems to still use banking reliably and securely, so yeah I'd say it's an excellent system. As far as GrapheneOS goes - now that they're partnered with Motorola they might actually get some certification, along with a proper security audit from Google. Not sure what the details of the supported functionality are gonna be there.
3 replies →
Ultimate seamless experience at the best value, best-in-class modern technology with intuitive mouth feel?