6 ms·

What do people with Linux phones do about banking apps? All my banks force me to do online banking through an app (at the very least used as a security token ge

What do people with Linux phones do about banking apps? All my banks force me to do online banking through an app (at the very least used as a security token generator). I would really love to have a Linux phone but I'm stuck with Android because of that.

npteljes 4y ago
My bank has a website where you can do banking online, and I use that.
seba_dos1 4y ago
Personally, I'm using Anbox to occasionally run a single Android app on my Librem 5 and it's a banking app (Polish mBank), which works fine with it. For what it's worth, that app isn't actually necessary, but comes with some handy features that aren't available on their Web frontend like token-based payments that can be used in ATMs or shop terminals without using a card, which is what I'm using the app for (regular payments can be easily made via the browser).
selfhoster11 4y ago
The best I can advise is try to access it via the online banking website, if available. Otherwise, you simply cannot use mobile banking apps unless you have some way to emulate a sufficiently "verified" Android environment somewhere (on your phone or some VM somewhere else), and use that to open the app.
- goethes_kind 4y ago
  I would never try to do online banking on my phone if possible. The banks have however decided that issuing separate security dongles is too costly, so instead they forced us all to install an app that acts as a security token. So I cannot do online banking without the mobile app.
  - tpxl 4y ago
    I changed banks over their requirement of having an android or apple phone. The clerk gaped when I told her I don't have a smartphone.
  - 4ggr0 4y ago
    I would try to call them and flat-out tell them that you don't own a smartphone. Just tell them that you're using a dumb flipphone to communicate. Maybe they have a way to authenticate via SMS or alternative means. Else that would mean that peopler from an older generation who still don't have smartphones are just excluded from using this bank, which would be strange. Else your only option is to buy a cheap android phone which you only use for this login. In a way that makes your banking activities even more secure because you're only using the device for 2FA codes :)
    - fsflover 4y ago
      Except this insecure, non-updated device would also be sending tonns of data to Google continuously.
      - 4ggr0 4y ago
        I know that security cracks will not like what follows - If you only use it for 2FA codes, does it really matter?
        fsflover 4y ago
        It matters, because your insecure device will be sending data to outside servers without your control, possibly with buggy software interceptable by hackers. So your 2FA codes could be technically intercepted before you know it.
daptaq 4y ago
Not everyone uses banking apps?
- ridgered4 4y ago
  Are the requirements different in different parts of the world? I've never used a banking app, I just use a web browser on my desktop.
  - ocdtrekkie 4y ago
    I didn't use banking apps when I used Windows Mobile for years, but the big thing I've since found handy is mobile deposit. Generally without a phone app, you have to drive your checks to the bank.
bitL 4y ago
No good solution. Perhaps a cheap Android for $30 just for those apps... Maybe running Android in a VM inside a computer would work for that?
- narag 4y ago
  That's what I plan to do. But $30? ~100€ is the minimum I've found. Do you have a link? Or maybe you meant non-Android...
  - nousermane 4y ago
    $30 and even less is not uncommon for an older, slightly scuffed up, used phone. Or maybe you already have one, laying far back in your desk's drawer. Not a kind of phone most people would use as a daily driver. But as a dedicated bank-app thing - sure, why not. Just don't connect it to untrusted wifi, disable bluetooth and all that. Chances are - that phone had its last OS update years ago, and could be pretty easily pwned [0] [0] https://gist.github.com/jesux/64cf037c55c0d42196762c0ccacc7380 https://gist.github.com/jesux/64cf037c55c0d42196762c0ccacc73...
cunidev 4y ago
If SafetyNet checks are not a concern, several people used banking apps inside Android runtimes (like Waydroid) on their Pinephones. Clearly not ideal for everyday operation, but for occasional tasks it does the job decently well and the overhead is low
kop316 4y ago
I guess it depends on how much you use it? On the Linux phone itself, you can try out Waydroid https://waydro.id https://waydro.id (and it seems to work on regular Linux too?). I also think there are Android Distros you can install in a VM as well (though I admit I have not tried it).
troyvit 4y ago
Honestly I recommend switching banks. I don't use a linux phone yet but I just tested my credit union's web site[1]. Not only does it work but it has a mobile version that seems -- now that I look at it -- more functional than the app. [1] Security Service Federal Credit Union
- kobalsky 4y ago
  > more functional than the app given the increasing insanity that is getting a mobile app published and updated, I'd say that this will be normal than not in the future. you need a team devoted to keep up with the monthly threat of your app getting removed because some new requirement. the upkeep is terrible.
- SoftTalker 4y ago
  I use a local credit union as well and also just use their website.
mhd 4y ago
Interesting to hear this. I'm getting a bit annoyed about too much reliance on iOS/Android apps myself, but at least for most banks around here I still have the option of alternatives. I do miss my printed out lists of verification numbers, but I could pay for SMS delivery or get one of those smartcard readers. Which, now that I looked it up, seem to be a German peculiarity. https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_Sm@rt-TAN_/_CardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... Another annoyance lately is traveling. I need two apps for the car sharing services, two for public transit, maybe another handful for scooters/bike rental etc.
ge96 4y ago
Wonder could you write one with Plaid.
afandian 4y ago
In what country? In the UK I've never been forced (or even encouraged) to install the banking app. Which is lucky, becuase I'd sooner switch bank.
- weberer 4y ago
  In Finland, you have to use a bank's authentication service to do pretty much anything. Most people use a mobile app for that, but paper codes work as well.
- tpoacher 4y ago
  Also in the UK and have no idea what you're on about. All major banks require app-based authentication. Many also offer sms as an alternative, but this is being phased out across the board. A handful maaaay still allow you to do banking via physical cardreader verification if all else fails (and you have no record of having ever installed an app).
  - tomxor 4y ago
    > All major banks require app-based authentication [...] A handful maaaay still allow you to do banking via physical cardreader verification [...] Uhm no... I can personally attest to at least Barclays and Natwest allowing you to use a cardreader + website, no apps needed, all online services available through website. Those are 2 of the top 4 largest banks in the UK, I wouldn't be surprised if it was a similar story for the rest. I imagine they would get in pretty deep legal trouble if they forced people to use smart phones. Just because you don't try to use stuff without an app doesn't mean it doesn't exist anymore, I don't have a smart phone - life is good in the UK.
    - tpoacher 4y ago
      These are all slowly being phased out. That's the point. I'm on Natwest too, which is one of the banks I'm actually referring to. As soon as I installed the app (for unrelated reasons) it started requiring it for authentication, even though I never chose that as an option, and it persisted even after I had uninstalled it. It is not impossible to work around it, but it's definitely not a pleasant experience, especially not when dealing with payments. My recent experience is that Natwest at least has been adding 'friction' for doing things without the app. Case in point, I needed to change my address recently. I explicitly wanted to avoid the app, because it mandated establishing a biometric password. I tried the website, the website redirected me to a telephone number. I called the number, 30 minutes later, it happily informed me that "Great. What you're trying to do is possible from the app. Why not download ...". In the end I took half a day off from work and went to the bank in person and asked a human to update my details. But judging from other industries, and seeing how the app is being pushed, I have no expectations that "human customer support" is going to be a thing for much longer (except for the typical "Helloooo I'm here to walk you through the app via a script I cannot deviate from" annoying kind).
weberer 4y ago
Nordea gives you paper codes when you sign up. You can do everything through their website as long as you use those codes for MFA. Each time you authenticate, you have to use the next code in the series. Once you run out, you go to the bank and pick up another code book.
nikodunk 4y ago
As someone who builds the banking apps of joinatmos.com, uses linux on desktop and aspires to use it on phone - I’ve been thinking about this too. Our react native build won’t support Linux (say, Flathub) very well at all, and building a separate GTK app is not cost effective for a startup. Flutter could work, or if we’d made our mobile app a wrapped website in Cordova or whatever that would have been an option I believe too. For now, our mobile Linux users would be “stuck” with the mobile web experience, though we tried our hardest to make it a performant PWA that you can pin to your home screen. The main thing you lose is persistent biometric login, though many privacy conscious users seem to not trust biometric unlocking of your session in the first place (they mistakenly think their Face is being uploaded to our servers, which is of course not how the technology works on iOS/Android) so that may not be an issue. Edit: From my time trying to use a dumbphone as a daily driver a few years ago, cash apps were a bigger problem (Venmo, etc) as theres a social component to “not paying someone back until later because I dont have a smartphone”.
- fezfight 4y ago
  I dunno about you, but I'd prefer it all just work via Firefox, so assuming that's functioning, you'd have my business.
- NewJazz 4y ago
  though many privacy conscious users seem to not trust biometric unlocking of your session in the first place (they mistakenly think their Face is being uploaded to our servers, which is of course not how the technology works on iOS/Android) For me, my hesitation with biometric unlocking is due to it being legally weaker than a passcode. https://www.biometricupdate.com/202007/another-federal-court-says-biometrics-can-be-used-to-open-devices-if-a-warrant-has-been-issued https://www.biometricupdate.com/202007/another-federal-court...
  - nikodunk 4y ago
    I see good point.
- CameronNemo 4y ago
tpoacher 4y ago
Yes, it's insidious isn't it. I wish I could say the answer is to find a bank that doesn't do it, but there don't seem to be any. The whole thing verges on apocalyptic.
- mastazi 4y ago
  Personally I hadn't heard about this until a minute ago, which means that luckily there are banks that don't require a mobile app...
Jhsto 4y ago
The Venn diagram of Linux phone users and people who want to reduce proprietaries in their life is rather big. That's to say it's almost the point of the hardware to point you these problems. And in my opinion, frankly, your anecdote is more about your choice of bank and not which phone you use. That being said, what about banks with open APIs? Wasn't there some EU legislation?
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- megous 4y ago
  It's "open" api for some bullshit aggregation data slurping services, not for normal customers to access their data directly and easily for themselves on their own hardware in automated way. There are banks with nice XML/JSON based API specially made for easy syncing and login via API keys you generate in a normal bank web UI. But those are very rare. If anything EU fucked up all my bank automation, except for this one bank, by requiring 2FA just for logging in, and not only for making transactions.
linmob 4y ago
My bank (comdirect in Germany) fortunately has an okay mobile-friendly website and sells a tiny hardware device to generate the "TAN" for their weird proprietary way to secure transactions.
kn0where 4y ago
In the US in my experience, it seems like all banks rely on SMS or email-based 2-factor. I’m sure that will change but our financial institutions are perpetually behind the times. So at least for American users, the lack of banking apps isn’t much of an issue.
marcodiego 4y ago
I stopped using my bank's online service the day they required a proprietary service[1] installed. It is very inconvenient, I have to go the physical agency to get info I could get from my pocket anywhere, but that is the price I'm willing to pay if they require me to continuously run proprietary code on my own device. [1] https://seg.bb.com.br/passo-a-passo.html?system=Linux https://seg.bb.com.br/passo-a-passo.html?system=Linux
mastazi 4y ago
Personally I don't do online banking on the phone, but your mileage may vary depending on your needs and how often you are away from a desktop.
deleted 4y ago
[deleted]

npteljes 4y ago

My bank has a website where you can do banking online, and I use that.

seba_dos1 4y ago

Personally, I'm using Anbox to occasionally run a single Android app on my Librem 5 and it's a banking app (Polish mBank), which works fine with it. For what it's worth, that app isn't actually necessary, but comes with some handy features that aren't available on their Web frontend like token-based payments that can be used in ATMs or shop terminals without using a card, which is what I'm using the app for (regular payments can be easily made via the browser).

selfhoster11 4y ago

The best I can advise is try to access it via the online banking website, if available. Otherwise, you simply cannot use mobile banking apps unless you have some way to emulate a sufficiently "verified" Android environment somewhere (on your phone or some VM somewhere else), and use that to open the app.

goethes_kind 4y ago
I would never try to do online banking on my phone if possible. The banks have however decided that issuing separate security dongles is too costly, so instead they forced us all to install an app that acts as a security token. So I cannot do online banking without the mobile app.
- tpxl 4y ago
  I changed banks over their requirement of having an android or apple phone. The clerk gaped when I told her I don't have a smartphone.
- 4ggr0 4y ago
  I would try to call them and flat-out tell them that you don't own a smartphone. Just tell them that you're using a dumb flipphone to communicate. Maybe they have a way to authenticate via SMS or alternative means. Else that would mean that peopler from an older generation who still don't have smartphones are just excluded from using this bank, which would be strange. Else your only option is to buy a cheap android phone which you only use for this login. In a way that makes your banking activities even more secure because you're only using the device for 2FA codes :)
  - fsflover 4y ago
    Except this insecure, non-updated device would also be sending tonns of data to Google continuously.
    - 4ggr0 4y ago
      I know that security cracks will not like what follows - If you only use it for 2FA codes, does it really matter?
      - fsflover 4y ago
        It matters, because your insecure device will be sending data to outside servers without your control, possibly with buggy software interceptable by hackers. So your 2FA codes could be technically intercepted before you know it.

daptaq 4y ago

Not everyone uses banking apps?

ridgered4 4y ago
Are the requirements different in different parts of the world? I've never used a banking app, I just use a web browser on my desktop.
- ocdtrekkie 4y ago
  I didn't use banking apps when I used Windows Mobile for years, but the big thing I've since found handy is mobile deposit. Generally without a phone app, you have to drive your checks to the bank.

bitL 4y ago

No good solution. Perhaps a cheap Android for $30 just for those apps... Maybe running Android in a VM inside a computer would work for that?

narag 4y ago
That's what I plan to do. But $30? ~100€ is the minimum I've found. Do you have a link? Or maybe you meant non-Android...
- nousermane 4y ago
  $30 and even less is not uncommon for an older, slightly scuffed up, used phone. Or maybe you already have one, laying far back in your desk's drawer. Not a kind of phone most people would use as a daily driver. But as a dedicated bank-app thing - sure, why not. Just don't connect it to untrusted wifi, disable bluetooth and all that. Chances are - that phone had its last OS update years ago, and could be pretty easily pwned [0] [0] https://gist.github.com/jesux/64cf037c55c0d42196762c0ccacc7380 https://gist.github.com/jesux/64cf037c55c0d42196762c0ccacc73...

cunidev 4y ago

If SafetyNet checks are not a concern, several people used banking apps inside Android runtimes (like Waydroid) on their Pinephones. Clearly not ideal for everyday operation, but for occasional tasks it does the job decently well and the overhead is low

kop316 4y ago

I guess it depends on how much you use it? On the Linux phone itself, you can try out Waydroid https://waydro.id https://waydro.id (and it seems to work on regular Linux too?). I also think there are Android Distros you can install in a VM as well (though I admit I have not tried it).

troyvit 4y ago

Honestly I recommend switching banks. I don't use a linux phone yet but I just tested my credit union's web site[1]. Not only does it work but it has a mobile version that seems -- now that I look at it -- more functional than the app. [1] Security Service Federal Credit Union

kobalsky 4y ago
> more functional than the app given the increasing insanity that is getting a mobile app published and updated, I'd say that this will be normal than not in the future. you need a team devoted to keep up with the monthly threat of your app getting removed because some new requirement. the upkeep is terrible.
SoftTalker 4y ago
I use a local credit union as well and also just use their website.

mhd 4y ago

Interesting to hear this. I'm getting a bit annoyed about too much reliance on iOS/Android apps myself, but at least for most banks around here I still have the option of alternatives. I do miss my printed out lists of verification numbers, but I could pay for SMS delivery or get one of those smartcard readers. Which, now that I looked it up, seem to be a German peculiarity. https://en.wikipedia.org/wiki/Transaction_authentication_number#ChipTAN_/_Sm@rt-TAN_/_CardTAN https://en.wikipedia.org/wiki/Transaction_authentication_num... Another annoyance lately is traveling. I need two apps for the car sharing services, two for public transit, maybe another handful for scooters/bike rental etc.

ge96 4y ago

Wonder could you write one with Plaid.

afandian 4y ago

In what country? In the UK I've never been forced (or even encouraged) to install the banking app. Which is lucky, becuase I'd sooner switch bank.

weberer 4y ago
In Finland, you have to use a bank's authentication service to do pretty much anything. Most people use a mobile app for that, but paper codes work as well.
tpoacher 4y ago
Also in the UK and have no idea what you're on about. All major banks require app-based authentication. Many also offer sms as an alternative, but this is being phased out across the board. A handful maaaay still allow you to do banking via physical cardreader verification if all else fails (and you have no record of having ever installed an app).
- tomxor 4y ago
  > All major banks require app-based authentication [...] A handful maaaay still allow you to do banking via physical cardreader verification [...] Uhm no... I can personally attest to at least Barclays and Natwest allowing you to use a cardreader + website, no apps needed, all online services available through website. Those are 2 of the top 4 largest banks in the UK, I wouldn't be surprised if it was a similar story for the rest. I imagine they would get in pretty deep legal trouble if they forced people to use smart phones. Just because you don't try to use stuff without an app doesn't mean it doesn't exist anymore, I don't have a smart phone - life is good in the UK.
  - tpoacher 4y ago
    These are all slowly being phased out. That's the point. I'm on Natwest too, which is one of the banks I'm actually referring to. As soon as I installed the app (for unrelated reasons) it started requiring it for authentication, even though I never chose that as an option, and it persisted even after I had uninstalled it. It is not impossible to work around it, but it's definitely not a pleasant experience, especially not when dealing with payments. My recent experience is that Natwest at least has been adding 'friction' for doing things without the app. Case in point, I needed to change my address recently. I explicitly wanted to avoid the app, because it mandated establishing a biometric password. I tried the website, the website redirected me to a telephone number. I called the number, 30 minutes later, it happily informed me that "Great. What you're trying to do is possible from the app. Why not download ...". In the end I took half a day off from work and went to the bank in person and asked a human to update my details. But judging from other industries, and seeing how the app is being pushed, I have no expectations that "human customer support" is going to be a thing for much longer (except for the typical "Helloooo I'm here to walk you through the app via a script I cannot deviate from" annoying kind).

weberer 4y ago

Nordea gives you paper codes when you sign up. You can do everything through their website as long as you use those codes for MFA. Each time you authenticate, you have to use the next code in the series. Once you run out, you go to the bank and pick up another code book.

nikodunk 4y ago

As someone who builds the banking apps of joinatmos.com, uses linux on desktop and aspires to use it on phone - I’ve been thinking about this too. Our react native build won’t support Linux (say, Flathub) very well at all, and building a separate GTK app is not cost effective for a startup. Flutter could work, or if we’d made our mobile app a wrapped website in Cordova or whatever that would have been an option I believe too. For now, our mobile Linux users would be “stuck” with the mobile web experience, though we tried our hardest to make it a performant PWA that you can pin to your home screen. The main thing you lose is persistent biometric login, though many privacy conscious users seem to not trust biometric unlocking of your session in the first place (they mistakenly think their Face is being uploaded to our servers, which is of course not how the technology works on iOS/Android) so that may not be an issue. Edit: From my time trying to use a dumbphone as a daily driver a few years ago, cash apps were a bigger problem (Venmo, etc) as theres a social component to “not paying someone back until later because I dont have a smartphone”.

fezfight 4y ago
I dunno about you, but I'd prefer it all just work via Firefox, so assuming that's functioning, you'd have my business.
NewJazz 4y ago
though many privacy conscious users seem to not trust biometric unlocking of your session in the first place (they mistakenly think their Face is being uploaded to our servers, which is of course not how the technology works on iOS/Android) For me, my hesitation with biometric unlocking is due to it being legally weaker than a passcode. https://www.biometricupdate.com/202007/another-federal-court-says-biometrics-can-be-used-to-open-devices-if-a-warrant-has-been-issued https://www.biometricupdate.com/202007/another-federal-court...
- nikodunk 4y ago
  I see good point.
CameronNemo 4y ago

tpoacher 4y ago

Yes, it's insidious isn't it. I wish I could say the answer is to find a bank that doesn't do it, but there don't seem to be any. The whole thing verges on apocalyptic.

mastazi 4y ago
Personally I hadn't heard about this until a minute ago, which means that luckily there are banks that don't require a mobile app...

Jhsto 4y ago

The Venn diagram of Linux phone users and people who want to reduce proprietaries in their life is rather big. That's to say it's almost the point of the hardware to point you these problems. And in my opinion, frankly, your anecdote is more about your choice of bank and not which phone you use. That being said, what about banks with open APIs? Wasn't there some EU legislation?

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
megous 4y ago
It's "open" api for some bullshit aggregation data slurping services, not for normal customers to access their data directly and easily for themselves on their own hardware in automated way. There are banks with nice XML/JSON based API specially made for easy syncing and login via API keys you generate in a normal bank web UI. But those are very rare. If anything EU fucked up all my bank automation, except for this one bank, by requiring 2FA just for logging in, and not only for making transactions.

linmob 4y ago

My bank (comdirect in Germany) fortunately has an okay mobile-friendly website and sells a tiny hardware device to generate the "TAN" for their weird proprietary way to secure transactions.

kn0where 4y ago

In the US in my experience, it seems like all banks rely on SMS or email-based 2-factor. I’m sure that will change but our financial institutions are perpetually behind the times. So at least for American users, the lack of banking apps isn’t much of an issue.

marcodiego 4y ago

I stopped using my bank's online service the day they required a proprietary service[1] installed. It is very inconvenient, I have to go the physical agency to get info I could get from my pocket anywhere, but that is the price I'm willing to pay if they require me to continuously run proprietary code on my own device. [1] https://seg.bb.com.br/passo-a-passo.html?system=Linux https://seg.bb.com.br/passo-a-passo.html?system=Linux

mastazi 4y ago

Personally I don't do online banking on the phone, but your mileage may vary depending on your needs and how often you are away from a desktop.

deleted 4y ago

[deleted]