In Holland, GrapheneOS users are being targeted by police after "busting" a re-seller. The owners of the phones got raided without them being involved in any investigation. Just having the phone was enough to get a knock.
Supposedly the Dutch police had "cracked" their phones.
According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.
His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.
This is the issue with being lenient on crime but also being liberal. You have to search for the "right" patterns to find your criminal. It happens that folks who care about privacy, and criminals, two distinct groups search and use the same set of technologies: wether it's grapheneOS, or others. I am also tired of people still looking suspicious at me for not having instagram, snap or tiktok or use whatsapp, it's like I dropped out of society, and that I use linux and use open source email clients/server, I use ublock origin advanced with blocking of scripts and 3rd party domains. Why privacy is an uphill daily battle.
> Police were looking for […] Google Pixel phones. These have become popular among criminals in recent years […]. Among others, the murderers of Dutch crime reporter Peter R. de Vries had Google Pixel devices with them during the attack.
This is so braindead, it’s the same as “a black person committed a crime, lets search all black people!”
If someone with an iPhone commits a crime, will they do the same?
SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
I don't know if there is a common API standard from a technical point of view, but there is the legal framework for it. Banks in the the EU have to provide an access to third parties who provide account information services to clients (themselves being regulated and supervised by a national agency). I would assume because it is mandatory, it is in the interest of banks to share costs and provide a single unified technical API, since they all have to spend the money anyway.
Open banking isn’t mandatory. Psd2 and successors are. But it does not require the banks to expose feature parity APIs so others can replicate their apps.
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
People need to stop calling for the EU "to step in", they already have and made everything worse. They forced PSD2 with """"""""""""""Open Banking""""""""""""""" which requires convoluted requirements and is regulated to death so no private person can call the API themselves and get e.g. their balance or transactions.
Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
I thought that one of the goals of Wero was to become less dependent on US technology (Paypal). By requiring you to use either Android or iOS it seems to me as if that is more of a marketing ploy than anything else. As multiple other banks that support Wero however run on non-Google Android I think it is more likely that whoever wrote that message just doesn't know what they are talking about.
There will be no independence of US tech as long as everyone in europe has google or apple in their pocket and most administrations have windows on their PC. But, at least in germany, ruling parties are very slow to notice this.
My mortgage was with a bank that had a website but no app and I was happy, and then they merged with another bank and only had an app and no website and I was not at all happy (but the bank they merged with also had their own mortgage product with both app and website and I do not know why they didn't migrate to using that platform). I swiftly moved to a bank that incidentally had a lower interest and both a competent app and website, and I noted to the previous merged bank that the reason I was leaving is that they did not accommodate me. Whether that feedback was heard, I'm unsure.
Not an option if all banks follow suit. If this trend continues you would only switch to a bank who hasn't yet locked down their app yet.
Hopping banks is easy for just savings, but a lot of work and inconvenience for your standard payment accounts, and that's ignoring additional services like mortgages and insurance.
Indeed. It also fights symptoms rather than the underlying issue - that Google Play Integrity is an anti-competitive method that Google uses to shut out competition. The fact that Google-certified phones that are months behind on critical security updates (or even have malware in there updates as a recent case) do get a pass, shows that it is mostly about destroying competition in the smartphone ecosystem as early as possible.
The solution is not voting with your wallet, but either leveraging the DMA or drafting new laws that counter this.
Either Google should be forced to approve secure alternatives like GrapheneOS or companies should be required to also implement AOSP attestation. Or alternatively, remote attestation should be banned completely, but I can see that it serves some legitimate uses.
I love how people think "vote with your wallet" is an option on most "vote with your wallet" issues. If people could vote with their wallets they wouldn't have to, would they?
Vote with your vote for politicians for common sense regulations that favor the consumer at the expense of everything else.
This is how it should work, but not how it does. Dutch banks don't pass down increases in interest rates simply because the risk of losing customers is so low [1]. Dutch consumers don't want, can't be bothered, or have such loyalty to their bank of choice, that even a criminally-low rate won't convince them to switch bank
My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years...
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess?
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
> The Rabobank app works fine on Android phones that haven't seen updates in years...
Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.
For Google control is the issue (and the data flowing with it), not security, and once again we in Europe just swallow that shit and mess up our supposed "open" standards. In this case it really is because there are no competent people making these decisions. They just trust Google when they say: "It's for security".
I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the US and YOU throwing YOUR privacy conscious users under the bus.
Of course they pass system integrity. The whole point of the thing is not "it should be secure", it's "the user has not messed with it so we control it".
Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
Just a heads-up from a fellow Pixel 6 owner: it has reached end-of-life last month, because the five years since the launch in October 2021 are up. Better start looking for a replacement soon.
ASN was pretty bad - they recently wanted me to renew KYC/ID info. They wanted to install a Chrome Plugin that then would read the government KYC data. I nope'd out of that very fast. The alternative indeed was an app.
Dont take the fact that Wero still works for Bunq as an indicator that ASN or any other bank are doing something especially untowards.
Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.
I can't take bunq seriously because every time I approve a direct debit I keep seeing two transactions in the log -- one already processed and another still pending and also asking me to enter the pin again after it was approved.
This will keep happening so long as GrapheneOS is a "niche" operating system. We need to build up economic leverage by increasing GrapheneOS usage numbers until they can no longer afford to block it.
My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits.
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.
So we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can be mitmed when the system trust store is manipulated
The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.
I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem
> To maintain that level of quality, we also need to be clear about our system requirements and avoid dedicating resources to troubleshooting issues on unsupported platforms and configurations.
This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue.
One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on.
But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.
ASN has been dysfunctional for years. They needed a bailout and ever since have only deteriorated in their operations. To be fair, their risk management has surely improved and their new CEO is great. But their actual operations are superbad. They only do the easy loans and mortgages because anything else they can't do. Still I think as a bank they are doing well, everyone is opening accounts there. Marketing matters more than service I suppose.
It's a bit outdated. The big green one isn't in the government majority ownership for a year and some now, so we installed back those glass shelves and cocaine dispensers in all restrooms by now.
Also, Wero is going to be used for tap-to-pay in stores (initial roll-out planned for 2027). Carrying a second phone is going to be old pretty soon. Also, I think we should fight this on principle.
The title sets a lot of blame on the bank, but there might be other factors at play. It is possible that either national or european regulations or laws makes it mandatory for the banks to comply with a set of security features that makes it impossible for them to offer services to degoogled phones. There might not be any alternative because it would cost too much money to develop and more importantly to distribute it. It can also be the case that Google uses its influence over the android open source project to make sure it will never be the case.
If Wero (assuming it's Wero) can push banks to implement Play Integrity, they can also make some guidelines or make a small SDK to for AOSP remote attestation. It's not terribly hard to implement and some banks already do.
I don't think there is an actual written regulation that talks about attestation or SafetyNet.
I can imagine in some meeting with the ministry or an industry association that somebody in charge said "implement all safety measures that Google and Apple provide, no excuses" and they just execute it.
I could also imagine there is a real need to do so. Maybe somebody found that criminals use rooted phones to robotically launder money or something like that. Or there was a criminal case where someone got a bank account with a fake ID and used it on a burner phone. Then the developers get a discrete notice from law enforcement or regulatory bodies and are told to close that gap. Who knows?
Probably in-person at a branch. However they are allowed to use technology for certain tasks; their elders just have to discuss (and vote?) on it first.
Incidentally I was happy to see that while they're phasing out their previous cryptographic identification device (that you put your bank card in) they will still support some kind of cryptographic usb dongle (in addition to smartphones).
When I wanted to open a second account a few months back, ABN is the only bank I have not tried because, well, I have my first account with them... I could not find similar option with any other, though.
Not quite true. All banks really want you to use their app, and the neobanks actually demand it (and get away with it because they are not as important as the so-called system banks).
But look at the pages more carefully, and you'll note that there is a way to open an account using just a web browser too (e.g., look at abnamro.nl). The links are deemphasised by using dark UI patterns of course.
ING is being really dirty about this. It should be possible to open an account, and get the OTP hardware device that reads the chip on the debit card, but they don't document how you can open an account without the app. It's probably possible, as existing customers can bank without the app, but you will probably have to call them.
Banks would love to get rid of all those nasty people without approved smartphones, but that would cause political pushback.
Supposedly the Dutch police had "cracked" their phones.
In Dutch https://archive.is/3wawb
According to our information, the reseller did not distribute official GrapheneOS. Using AI tools, he had built his own fork and added mobile device management (MDM) for remote administration. The result was a separate operating system that lacked, among other things, the security updates of the original project.
His signing keys for that system were probably compromised. Anyone holding those keys can build an update that the phones accept as genuine. Such an update was apparently installed on seized phones via ADB (Android Debug Bridge), an interface that requires a USB cable connection, and probably removed the screen lock. The phones could then be examined forensically. On our information, the authorities again needed the phone in their hands. On official GrapheneOS, the same approach would require the project's own signing keys.
https://www.joint-defense-team.com/post/grapheneos-cracked-p...
This is so braindead, it’s the same as “a black person committed a crime, lets search all black people!”
If someone with an iPhone commits a crime, will they do the same?
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
But that is quite limited.
Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
https://github.com/PrivSec-dev/banking-apps-compat-report/is...
I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.
My mortgage was with a bank that had a website but no app and I was happy, and then they merged with another bank and only had an app and no website and I was not at all happy (but the bank they merged with also had their own mortgage product with both app and website and I do not know why they didn't migrate to using that platform). I swiftly moved to a bank that incidentally had a lower interest and both a competent app and website, and I noted to the previous merged bank that the reason I was leaving is that they did not accommodate me. Whether that feedback was heard, I'm unsure.
Hopping banks is easy for just savings, but a lot of work and inconvenience for your standard payment accounts, and that's ignoring additional services like mortgages and insurance.
The solution is not voting with your wallet, but either leveraging the DMA or drafting new laws that counter this.
Either Google should be forced to approve secure alternatives like GrapheneOS or companies should be required to also implement AOSP attestation. Or alternatively, remote attestation should be banned completely, but I can see that it serves some legitimate uses.
Vote with your vote for politicians for common sense regulations that favor the consumer at the expense of everything else.
[1]: https://www.acm.nl/en/publications/acm-savings-rates-lag-beh...
That's not good enough, you also need to convince regular people to do the same. Your vote alone will not achieve anything.
I've completed my transfer this year. I am waiting a few more months to close my Dutch bank account (with the parent company of ASN). Good riddance.
No, it is not troubling, it is realistic for a service with high expectations and reliability expected, on tight schedules/resources
However, via Aurora store it works fine (inc Wero)... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess?
My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.
I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.
[0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe...
[1] https://walt.is/
[2] https://www.curve.com/
Exactly. If these companies were so serious about security, they should also block devices with, let's say, >1 year of security updates backlog. But that's a completely different number of customers compared to negligible Graphene/Lineage/e userbases.
I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the US and YOU throwing YOUR privacy conscious users under the bus.
Idk, this can be much improved :)
If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.
Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.
While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?
Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.
Let's see how long they let me keep it.
Peak clown computing.
Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.
Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.
I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem
This is such a corporate non-answer. If that was the problem, they could just detect the custom ROM and when someone calls support, the support agent could just say sorry not supported and hang up. I doubt that is the real issue.
One troubling possibility is that some security might be implemented client-side. Banks are ahead in security in some areas but far behind in others. Like in some cases you can just take money out of someones account if you know their account number, they rely on manual fraud detection, heuristics, and chargebacks. Instead of standard 2FA, my countries banks use a baroque parallel system. My password was for many years a word like "toast": It had a maximum length, had to be pronounceable over the telephone, was case insensitive etc.. Third party payment providers don't use something like OAuth but directly ask for my bank's password, and they used to just scrape the bank site, and so on.
But I think the real reason is regulatory, political, or due to pressure from the platforms. There is no pressing business or technical reason to go out of their way to block custom ROMs.
It also make me feel safer not to have always on me the key to all my accounts.
https://grapheneos.org/articles/attestation-compatibility-gu...
If Wero (assuming it's Wero) can push banks to implement Play Integrity, they can also make some guidelines or make a small SDK to for AOSP remote attestation. It's not terribly hard to implement and some banks already do.
I can imagine in some meeting with the ministry or an industry association that somebody in charge said "implement all safety measures that Google and Apple provide, no excuses" and they just execute it.
I could also imagine there is a real need to do so. Maybe somebody found that criminals use rooted phones to robotically launder money or something like that. Or there was a criminal case where someone got a bank account with a fake ID and used it on a burner phone. Then the developers get a discrete notice from law enforcement or regulatory bodies and are told to close that gap. Who knows?
> This app has started using Play Integrity to block new signups, existing accounts continue to work fine for now.
https://privsec.dev/posts/android/banking-applications-compa...
Is it legit?
All other banks only allow you to open an account via their app.
https://www.abnamro.nl/en/personal/payments/open-an-account/...
Incidentally I was happy to see that while they're phasing out their previous cryptographic identification device (that you put your bank card in) they will still support some kind of cryptographic usb dongle (in addition to smartphones).
When I wanted to open a second account a few months back, ABN is the only bank I have not tried because, well, I have my first account with them... I could not find similar option with any other, though.
But look at the pages more carefully, and you'll note that there is a way to open an account using just a web browser too (e.g., look at abnamro.nl). The links are deemphasised by using dark UI patterns of course.
ING is being really dirty about this. It should be possible to open an account, and get the OTP hardware device that reads the chip on the debit card, but they don't document how you can open an account without the app. It's probably possible, as existing customers can bank without the app, but you will probably have to call them.
Banks would love to get rid of all those nasty people without approved smartphones, but that would cause political pushback.