Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS

nikolay

Other European banks do it, too - N26 also rejects GrapheneOS.

ElDji

I have an refurbished iphone sleeping most of the time in my desk drawer, used only for banking apps. It also make me feel safer not to have always on me the key to all my accounts.

isoprophlex

Dont take the fact that Wero still works for Bunq as an indicator that ASN or any other bank are doing something especially untowards. Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.

ACCount39

SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it". Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality. By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.

kaon_2

ASN has been dysfunctional for years. They needed a bailout and ever since have only deteriorated in their operations. To be fair, their risk management has surely improved and their new CEO is great. But their actual operations are superbad. They only do the easy loans and mortgages because anything else they can't do. Still I think as a bank they are doing well, everyone is opening accounts there. Marketing matters more than service I suppose.

Aozora7

My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits. Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure. Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.

microtonal

Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken . From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN). If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.

teekert

My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years... However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess? Not how I'd architect it... My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work. I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay. [0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe... [1] https://walt.is/ [2] https://www.curve.com/

sebtron

However, ASN is the only Dutch bank that allows you to open and operate an account without owning and iOS or Android-based smartphone. All other banks only allow you to open an account via their app.

whazor

I think we really need an open hardware signing authority for open-source roms like GrapheneOS.

Freak_NL

The response from EPI/Wero in that thread is troubling: https://github.com/PrivSec-dev/banking-apps-compat-report/is... I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.

thibsrn

The title sets a lot of blame on the bank, but there might be other factors at play. It is possible that either national or european regulations or laws makes it mandatory for the banks to comply with a set of security features that makes it impossible for them to offer services to degoogled phones. There might not be any alternative because it would cost too much money to develop and more importantly to distribute it. It can also be the case that Google uses its influence over the android open source project to make sure it will never be the case.

croniev

I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though. Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone. While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?

TheChaplain

So, what is the reason for blocking GrapheneOS? Is it legit?

jsiepkes

So we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up. For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem. Great. Just great. Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.

captainmuon

> To maintain that level of quality, we also need to be clear about our system requirements and avoid dedicating resources to troubleshooting issues on unsupported platforms and configurations. This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue. One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on. But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.

amelius

Question: how do the Amish do banking?

stef25

In Holland, GrapheneOS users are being targeted by police after "busting" a re-seller. The owners of the phones got raided without them being involved in any investigation. Just having the phone was enough to get a knock. Supposedly the Dutch police had "cracked" their phones. In Dutch https://archive.is/3wawb

matheusmoreira

This will keep happening so long as GrapheneOS is a "niche" operating system. We need to build up economic leverage by increasing GrapheneOS usage numbers until they can no longer afford to block it.

joelhaasnoot

ASN was pretty bad - they recently wanted me to renew KYC/ID info. They wanted to install a Chrome Plugin that then would read the government KYC data. I nope'd out of that very fast. The alternative indeed was an app.