HN

Comments (79)

• Menu

  Arch-TK
  Thanks, but no thanks?I use GrapheneOS, but if you as a bank want to gate access to my money via some kind of technology, you better be including it as part of the account.For example, HSBC continues to let me manage my bank account via the web browser, and continues to offer a battery powered hardware token as the means of authentication.I let you hold my money, for whatever reason. Why do you expect me to be your distributed infrastructure provider? I am not going to let you require that I run your proprietary malware in order to access my own money.The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.I'd say that JS webapps are the same but at least there you run things on your terms in a sandbox that you can inspect and look at the requests, and there's no effective enclave carved out of your hardware (except for EME but that's another topic for another day and I'd be complaining if banks started to use it too).
• Menu

  edent
  In my experience with UK banks & financial institutions, GrapheneOS support can be roughly divided into four types.None. Explicitly banned. And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.Some. App works, but some functionality is unavailable. I've got a credit card app which works, but refuses to set up virtual cards or use "remember me". That's good enough for my use. Similarly, I had a merchant account which let me see my balance, but I couldn't use my phone as a credit card reader.Works, but only in main profile. I'd rather keep financial things in a locked profile. But lots of banks disallow that.Full. Everything works (although you may need to toggle some exploit protection off).Some banks are reasonably good at letting you pass on technical queries to their developers - mostly the smaller ones. The nice thing about the UK banking sector is that it is trivial to move banks. So I switched accounts to providers which worked with my phone and let the old ones know why I was moving.
• left-struck
  This post is awful, the link posted here is to a social media reply and even that reply does not contain a list of the 12 banks, it does however contain a link to a much larger list of banks, which are supported but not necessarily officially supported.
• Menu

  ronsor
  > many have memory corruption bugs and incorrect anti-tampering code requiring our per-app exploit protection compatibility mode toggleIronic for apps that are often so paranoid about "security" and "hardware attestation"
• Menu

  vaylian
  I wonder how many of these supported apps are supported, because there are some geeks on the inside of the banks who want to have their favorite mobile OS supported.
• Menu

  evolve2k
  Any idea which banks support “tap to pay”. Usually on Android or iPhone users access Googld pay or Apple Pay.Word is that banking apps that implement their own nfc interface within their app can be used for “tap to pay” on Graphene.Curious as to how we can know which providers support this.
• jruohonen
  The list is here:https://privsec.dev/posts/android/banking-applications-compa...Looks like good progress to me.
• no_time
  Mine (KH bank) does perform a safetynet attestation that fails, as I don't even pass basicintegrity, then proceeds to completely ignore the result and still let me in on GOS.I wonder if it's intentional.
• readthenotes1
  A better link to the actual list of hundreds of banking apps supportedhttps://privsec.dev/posts/android/banking-applications-compa...
• Menu

  iLoveOncall
  Why is the title "a dozen", when the link given in the post covers hundreds of banks that support it?
• ForHackernews
  Very good news. It's a good sign if banking companies are considering the actual security issues at play and not just blindly rejecting all unofficial ROMs.
• LoganDark
  I truly hope that this is not a pure whitelist of only the official signing keys via attestation.
• Roark66
  Why not lineageos23?
• Menu

  LightBug1
  Excellent. That was one of my main issues with Graphene.I'm just starting a deep-dive on it.As a newbie, can existing users point out any other gotchas?* EDIT: Oh ffs, only on Pixel phones ...
• shevy-java
  Good. I am tired of vendor-lock-in of a few corporations dominating the world here. Capitalism was never corporate-fascism - after all one element is free competition in a free market. This has been broken numerous times again and again, and the US justice department is deliberately unwilling to remedy this situation - thus also betraying the idea behind capitalism. No wonder since the orange mafia is running the show right now, with all signs of real dementia now being obvious.
• preisschild
  [dead]
• Menu

  OsrsNeedsf2P
  Is this new? It's unclear why the word "began" is in the title