edent
In my experience with UK banks & financial institutions,
GrapheneOS support can be roughly divided into four
types.None. Explicitly banned. And, though I feel bad for
saying it, I can't blame them. If some idiot roots their
phone and downloads malware, the bank may be responsible
for refunding them. I can see why they don't want that
headache.Some. App works, but some functionality is
unavailable. I've got a credit card app which works, but
refuses to set up virtual cards or use "remember me".
That's good enough for my use. Similarly, I had a merchant
account which let me see my balance, but I couldn't use my
phone as a credit card reader.Works, but only in main
profile. I'd rather keep financial things in a locked
profile. But lots of banks disallow that.Full. Everything
works (although you may need to toggle some exploit
protection off).Some banks are reasonably good at letting
you pass on technical queries to their developers - mostly
the smaller ones. The nice thing about the UK banking
sector is that it is trivial to move banks. So I switched
accounts to providers which worked with my phone and let
the old ones know why I was moving.
|
> embedding-shape
> The nice thing about the UK banking sector is that
it is trivial to move banks.Are there countries where
this is a hassle? Now I've only had personal banking
accounts in ~3 countries (so far?), so maybe I'm in a
bubble, but in none of the countries has "switching
banks" been more than basically create a new account,
start using new IBAN for incoming transfers, move
direct debits to use new IBAN and start using new
card(s). Those last two were even automatic in the
last move I did for a lot of stuff. Is it typically
more difficult than that in other countries?
|
> > TFNA
There are countries where, as a result of mergers,
banking is now down to 3-4 banks, and they all
have the same Android requirements, so switching
won't get one anywhere.
|
> > > embedding-shape
Right, but that's something else. Can't you
switch between those 3-4 banks though? That's
what I though was possible more or less all
over the world.
|
ronsor
> many have memory corruption bugs and incorrect
anti-tampering code requiring our per-app exploit
protection compatibility mode toggleIronic for apps that
are often so paranoid about "security" and "hardware
attestation"
|
> przmk
Because it's mostly about checking compliance boxes
than really caring about security.
|
> > paweladamczuk
Corporation are not able to "care". It's the
boxes's fault. That is, legislation and/or
enforcement.
|
> > > ironmagma
This meme again? Corporations are not capable
of anything, but corporations are made of
people, and people can care.
|
> > > > paweladamczuk
Call me cynical, but I would rather rely
on written regulations and systems of
checks than human altruism.
|
> > > > > II2II
True. Those who only care about
meeting regulatory requirements are
not going to care if the regulatory
requirements cease to exist. Those who
care about security may be dismissive
of regulatory requirements, but they
will do so primarily when they are
insufficient or when they conflict
with their opinion. In the former
case, they probably have the ability
to go beyond the regulatory
requirements. In the latter case:
while I won't claim that regulations
are perfect, I would trust them over
the an anonymous person who may be
going on anything from their personal
opinion to legitimate research.
|
> > > > > embedding-shape
Currently, besides if you use
cryptocurrencies, I don't think you
can rely solely on "written
regulations and systems of checks",
somewhere along those processes there
are a bunch of humans with their
altruism (or lack of), taste and daily
life moving those processes along. And
judging by the state of the
cryptocurrency ecosystem, this is
probably a good thing more than a bad
thing.
|
> > > > qwertyforce
We need a graph of empathy vs number of
people in organization
|
> > > RobotToaster
By that logic governments are not able to
"care" either.But both are examples of
cybernetic entities, if they don't care then
their control loops aren't correctly aligned.
|
> > > preisschild
Its not like govt agencies care about security
either. Its just "compliance" bs. Most
european eID stuff works like that.
|
readthenotes1
A better link to the actual list of hundreds of banking
apps
supportedhttps://privsec.dev/posts/android/banking-applica
tions-compa...
|
LoganDark
I truly hope that this is not a pure whitelist of only the
official signing keys via attestation.
|
LightBug1
Excellent. That was one of my main issues with
Graphene.I'm just starting a deep-dive on it.As a newbie,
can existing users point out any other gotchas?* EDIT: Oh
ffs, only on Pixel phones ...
|
Roark66
Why not lineageos23?
|
OsrsNeedsf2P
Is this new? It's unclear why the word "began" is in the
title
|
> pizzaiolo
After that guy was arrested for wiping his GrapheneOS
phone with a duress password, some reports appeared of
previously usable apps becoming unusable specifically
on GrapheneOS. This now reads like a possible reversal
of that trend.
|
> riedel
Where is this list of 12+ banks that explicitly allow
graphene. My understanding is if the banks do not
explicitly state support also in terms of ToS, they
might pull the rug any moment. With neo banks you are
then basically left without a bank.
|
> > riedel
I found some evidence of half a dozen that there
might be support 'by desogn' (all of them might
pull the rug at any time again as far as I
understand TOS, which however seems true for any
android in theory): Swissquote, Yuh, UBS, Starling
Bank, Triodos Bankieren NL, AmeriCU Credit Union.
More?
|
> blendergeek
That sentence is lifted from the post.
|