3 ms·

Yet, it seems like their app is closed-source and distributed via the android play store (it seems like the main way to interact with that bank?). I wish it wa

Yet, it seems like their app is closed-source and distributed via the android play store (it seems like the main way to interact with that bank?). I wish it was available as a reproducible build on F-Droid. That's how critical apps ought to be distributed. This is a common trope in security-oriented businesses: more security is a good thing, but the consumer often isn't afforded the same attention.

alias_neo 5y ago
It's also worth noting, (although there is nothing special about the security procedure described in OPs article; I'm in an industry that's been doing this for some time), Monzo doesn't stop you from running their app on a rooted Android phone; in some misguided belief that it's somehow more secure to prevent it, like all of the other major banks with their seriously sub-par app experiences (compared to Monzo).
yawnr 5y ago
You want this private (banking) company’s app to be open source? Lol
- OJFord 5y ago
  Why not, really? I wouldn't expect it to be - just because it's so not the norm - but why not? If you're talking about security, surely a closed-source app is just obscurity, there should be (sounds like there are) better precautions in place that it doesn't add anything. If it's ripping off features.. meh, is it really development time in frontend logic/UI that keeps Monzo ahead of any competitors its ahead of? (I'm saying that vaguely and unassertively because users seem to get very tribal and argumentative when it comes to 'challenger banks'!) If it's wanting to hide the API for whatever other 'it's proprietary' reason, well Monzo has a ('beta' and 'developer only' for years) public API anyway. And 'open' banking of course, so you can use TrueLayer or whatever anyway.
- MayeulC 5y ago
  Is most of their added value in the client app? I certainly doubt it. The app is probably a front-end that queries various API endpoints. Who could use the source code? Their competitors? Maybe, but there isn't that much competition in that space, and actually developing the app is certainly not the most difficult part. Auditing it probably is, and using a competitor's open source app as a base is probably a no-go for a lot of established players. For what purpose would they copy a functioning app? One thing I can see as an argument against would be raising the bar for would-be copycats and phishing attempts. Not that it raises it too much either. Or is it to limit documentation of their API? I know security trough obscurity is thought as a good additional measure in traditional banking, but that doesn't seem to be the case here. And reverse-engineering an app wouldn't be that complicated. I would actually love an open source, cross-bank app. Not sure why it couldn't happen. I'm not sure either what the value proposition is for banks to try and limit that kind of development. Control the user's interactions with the bank as much as possible? It's like these banking apps requiring "safetynet" or similar: they trust google or the manufacturer more than myself, while I am the actual client!
intunderflow 5y ago
We have an open API https://docs.monzo.com https://docs.monzo.com

alias_neo 5y ago

It's also worth noting, (although there is nothing special about the security procedure described in OPs article; I'm in an industry that's been doing this for some time), Monzo doesn't stop you from running their app on a rooted Android phone; in some misguided belief that it's somehow more secure to prevent it, like all of the other major banks with their seriously sub-par app experiences (compared to Monzo).

yawnr 5y ago

You want this private (banking) company’s app to be open source? Lol

OJFord 5y ago
Why not, really? I wouldn't expect it to be - just because it's so not the norm - but why not? If you're talking about security, surely a closed-source app is just obscurity, there should be (sounds like there are) better precautions in place that it doesn't add anything. If it's ripping off features.. meh, is it really development time in frontend logic/UI that keeps Monzo ahead of any competitors its ahead of? (I'm saying that vaguely and unassertively because users seem to get very tribal and argumentative when it comes to 'challenger banks'!) If it's wanting to hide the API for whatever other 'it's proprietary' reason, well Monzo has a ('beta' and 'developer only' for years) public API anyway. And 'open' banking of course, so you can use TrueLayer or whatever anyway.
MayeulC 5y ago
Is most of their added value in the client app? I certainly doubt it. The app is probably a front-end that queries various API endpoints. Who could use the source code? Their competitors? Maybe, but there isn't that much competition in that space, and actually developing the app is certainly not the most difficult part. Auditing it probably is, and using a competitor's open source app as a base is probably a no-go for a lot of established players. For what purpose would they copy a functioning app? One thing I can see as an argument against would be raising the bar for would-be copycats and phishing attempts. Not that it raises it too much either. Or is it to limit documentation of their API? I know security trough obscurity is thought as a good additional measure in traditional banking, but that doesn't seem to be the case here. And reverse-engineering an app wouldn't be that complicated. I would actually love an open source, cross-bank app. Not sure why it couldn't happen. I'm not sure either what the value proposition is for banks to try and limit that kind of development. Control the user's interactions with the bank as much as possible? It's like these banking apps requiring "safetynet" or similar: they trust google or the manufacturer more than myself, while I am the actual client!

intunderflow 5y ago

We have an open API https://docs.monzo.com https://docs.monzo.com