5 ms·

Do you use a banking app? Last I read depending on the type of check used some apps can still be problematic.

by nebulous1 3y ago

ravenstine 3y ago
Yes. Wells Fargo, Discover, Alliant CU, Venmo, Paypal, and M1 Finance all work.
zerreh50 3y ago
Same with McDonald's, interestingly enough
iforgotpassword 3y ago
So I guess next thing we need is someone sueing the fucking banks that do that. Mine luckily doesn't because I explicitly use an old phone with LineageOS, the banking app, and nothing else on it for online banking. It's arguably way more secure than using your main phone with a bazillion other Apps installed and online at all times.
- eganist 3y ago
  How would that stick? You can just sign into the bank via your web browser in the case of a nonfunctional app. The apps just give you added security assurances beyond using the web. "The app can't function in a low security environment, but complainant is free to use the web client in such event." case dismissed (obviously an oversimplification, but the point stands)
  - erinnh 3y ago
    This is definitely not the case everywhere. Where I live the app is 100% needed because it’s the „second factor“ in the login process.
    - The_Colonel 3y ago
      There has to be a fallback like SMS and/or automated call.
      - akvadrako 3y ago
        For my banks the only fallback is a hardware device that you put your card into. Before the app you had to carry this everywhere when traveling to do online banking.
      - Too 3y ago
        SMS is magnitudes less secure than the Secure Enclave in my phone. Fallback should never be the weakest link in a security chain. Especially not in something as high stakes as your banking login. I can’t remember how I got my first bank token in my phone. Probably by physically showing up in the bank office with my id.
        didntcheck 3y ago
        Agreed. Unfortunately almost every bank here forces me to use this less secure option "for security" due to my rooted phone. Not one has just offered standard TOTP (perhaps because the pull-only nature of it means they can't present the message explicitly telling the user what they're about to authorize. Which is an understandable qualm I guess)
        eganist 3y ago
        > SMS is magnitudes less secure than the Secure Enclave in my phone. The secure enclave on a rooted phone that no longer has execution integrity?
        The_Colonel 3y ago
        SMS 2FA is not great, but still seems to be more secure than a rooted phone. If your SMS OTP leaks to the attacker, they still need to know the first factor (password, biometrics) to gain access. Meanwhile, if your rooted phone is controlled by an attacker ... that's it, the attacker has everything.
  - oarsinsync 3y ago
    There are app-only banks too. Some of them provide a web interface, but it depends on the app to sign you into the web interface (similar to the way whatsapp requires you to use the app to sign into whatsapp web). What happens when you primary bank has been one of these app-only banks for the last 5 years, and you decide to make a technology change to your phone, and can now no longer get into your banking app?
  - realusername 3y ago
    When you reject GrapheneOS, the most secure mobile OS on the planet but accept a no-name chinese ROM I feel like that you can't invoke security reasons anymore.
  - Too 3y ago
    Signing transactions usually take you back to the 2FA app here, where the amount and receiver is repeated. Even if someone hijacks my computers web browser, the worst they can do is see my statements, any attempt to transfer out will pop up a prompt in the phone.
  - iforgotpassword 3y ago
    The app is for 2fa.
- udev4096 3y ago
  It's far from secure. You are using an outdated phone, which hasn't received any kind of firmware or vendor security patches in a while. And as far as I remember, LineageOS doesn't support relocking the bootloader which further reduces the overall security of your phone
  - iforgotpassword 3y ago
    What's the attack vector? There is nothing else installed on this phone, and I only turn it on when the banking website asks me to confirm the login via their app. So it's connected to my wifi for like 5 minutes. Meanwhile my main phone is always on the mobile network, using a proprietary modem that's running ridiculously complex firmware that does edge, lte, 5g, VoIP, has its own tcp/ip stack and a dozen other super complex protocols, is closed source, gets no security reviews and is exposed to at least my mobile provider at all times. And that's just the modem. Don't let me get started with all the value-add software the phone vendor loaded the device up with. Some of which is running with elevated privileges. You seriously think this is more secure?
- didntcheck 3y ago
  A lot of this actually seems to have come from recent regulatory pressure for 2FA (which I support in principle, don't get me wrong). I don't even think most of them have given much thought to rooted phones, rather they're just cargo culting Industry Standard Best Practices and turning all the device verification options to max. Luckily, most of them realize they still have customers without a compliant smartphone, or one at all, and offer a fallback, which is almost always SMS... Though you get those newer "app only" banks. I've never used any since I see that as a major downside, not a selling point, so idk whether they tolerate root. Even with traditional banks, I've come across a few features which can only be accessed via the phone app - in this case likely due to the belief that "web? Everyone just uses apps!" rather than security
vidarh 3y ago
Yeah, my bank app both did not work with rooted phones, last I checked, and they also appear to whitelist phone models or something - at one point I had an uncommon mid-range Chinese phone and I had to contact support to have them approve my phone.
jiminymcmoogley 3y ago
For UK banks on my Graphened Pixel 6a I can use the apps for HSBC, First Direct, Barclays, NatWest, RBS, Co-Operative Bank and Metro Bank with no issues, and have only had trouble with the Lloyds Bank app as of an update from maybe 2-3 months ago which throws an error saying they've detected I'm using a jailbroken/rooted device
- White_Wolf 3y ago
  I get a message that the device is not secure but I can still make transfers and such from the banking app on a rooted OP9Pro. Never tried to use NFC payments though.
- doublerabbit 3y ago
  Try using Monzo or Sterling. Both will nail you to the ground.
baby_souffle 3y ago
> Do you use a banking app? Last I read depending on the type of check used some apps can still be problematic. It's important to distinguish between banking app and payment app. If you just want to check your account balance or find an ATM, the banking app will probably not mind that you're on a device that can't pass integrity checks. If you want to use your phone's NFC to pay for coffee, though, you're going to have a bad time.
Xfx7028 3y ago
I use N26, Revolut, ING, and others. No issues, I just add the apps I need to the magisk hide list. I also use NFC payments. Only Google wallet does not work.
didntcheck 3y ago
Also many "corporate" things, usually depending on your org's policy. E.g. I can't run OpsGenie (it may actually be the Microsoft SSO step failing, I'm not entirely sure, but the error definitely mentions my device not meeting security policies)

Do you use a banking app? Last I read depending on the type of check used some apps can still be problematic.

ravenstine 3y ago

Yes. Wells Fargo, Discover, Alliant CU, Venmo, Paypal, and M1 Finance all work.

zerreh50 3y ago

Same with McDonald's, interestingly enough

iforgotpassword 3y ago

So I guess next thing we need is someone sueing the fucking banks that do that. Mine luckily doesn't because I explicitly use an old phone with LineageOS, the banking app, and nothing else on it for online banking. It's arguably way more secure than using your main phone with a bazillion other Apps installed and online at all times.

eganist 3y ago
How would that stick? You can just sign into the bank via your web browser in the case of a nonfunctional app. The apps just give you added security assurances beyond using the web. "The app can't function in a low security environment, but complainant is free to use the web client in such event." case dismissed (obviously an oversimplification, but the point stands)
- erinnh 3y ago
  This is definitely not the case everywhere. Where I live the app is 100% needed because it’s the „second factor“ in the login process.
  - The_Colonel 3y ago
    There has to be a fallback like SMS and/or automated call.
    - akvadrako 3y ago
      For my banks the only fallback is a hardware device that you put your card into. Before the app you had to carry this everywhere when traveling to do online banking.
    - Too 3y ago
      SMS is magnitudes less secure than the Secure Enclave in my phone. Fallback should never be the weakest link in a security chain. Especially not in something as high stakes as your banking login. I can’t remember how I got my first bank token in my phone. Probably by physically showing up in the bank office with my id.
      - didntcheck 3y ago
        Agreed. Unfortunately almost every bank here forces me to use this less secure option "for security" due to my rooted phone. Not one has just offered standard TOTP (perhaps because the pull-only nature of it means they can't present the message explicitly telling the user what they're about to authorize. Which is an understandable qualm I guess)
      - eganist 3y ago
        > SMS is magnitudes less secure than the Secure Enclave in my phone. The secure enclave on a rooted phone that no longer has execution integrity?
      - The_Colonel 3y ago
        SMS 2FA is not great, but still seems to be more secure than a rooted phone. If your SMS OTP leaks to the attacker, they still need to know the first factor (password, biometrics) to gain access. Meanwhile, if your rooted phone is controlled by an attacker ... that's it, the attacker has everything.
- oarsinsync 3y ago
  There are app-only banks too. Some of them provide a web interface, but it depends on the app to sign you into the web interface (similar to the way whatsapp requires you to use the app to sign into whatsapp web). What happens when you primary bank has been one of these app-only banks for the last 5 years, and you decide to make a technology change to your phone, and can now no longer get into your banking app?
- realusername 3y ago
  When you reject GrapheneOS, the most secure mobile OS on the planet but accept a no-name chinese ROM I feel like that you can't invoke security reasons anymore.
- Too 3y ago
  Signing transactions usually take you back to the 2FA app here, where the amount and receiver is repeated. Even if someone hijacks my computers web browser, the worst they can do is see my statements, any attempt to transfer out will pop up a prompt in the phone.
- iforgotpassword 3y ago
  The app is for 2fa.
udev4096 3y ago
It's far from secure. You are using an outdated phone, which hasn't received any kind of firmware or vendor security patches in a while. And as far as I remember, LineageOS doesn't support relocking the bootloader which further reduces the overall security of your phone
- iforgotpassword 3y ago
  What's the attack vector? There is nothing else installed on this phone, and I only turn it on when the banking website asks me to confirm the login via their app. So it's connected to my wifi for like 5 minutes. Meanwhile my main phone is always on the mobile network, using a proprietary modem that's running ridiculously complex firmware that does edge, lte, 5g, VoIP, has its own tcp/ip stack and a dozen other super complex protocols, is closed source, gets no security reviews and is exposed to at least my mobile provider at all times. And that's just the modem. Don't let me get started with all the value-add software the phone vendor loaded the device up with. Some of which is running with elevated privileges. You seriously think this is more secure?
didntcheck 3y ago
A lot of this actually seems to have come from recent regulatory pressure for 2FA (which I support in principle, don't get me wrong). I don't even think most of them have given much thought to rooted phones, rather they're just cargo culting Industry Standard Best Practices and turning all the device verification options to max. Luckily, most of them realize they still have customers without a compliant smartphone, or one at all, and offer a fallback, which is almost always SMS... Though you get those newer "app only" banks. I've never used any since I see that as a major downside, not a selling point, so idk whether they tolerate root. Even with traditional banks, I've come across a few features which can only be accessed via the phone app - in this case likely due to the belief that "web? Everyone just uses apps!" rather than security

vidarh 3y ago

Yeah, my bank app both did not work with rooted phones, last I checked, and they also appear to whitelist phone models or something - at one point I had an uncommon mid-range Chinese phone and I had to contact support to have them approve my phone.

jiminymcmoogley 3y ago

For UK banks on my Graphened Pixel 6a I can use the apps for HSBC, First Direct, Barclays, NatWest, RBS, Co-Operative Bank and Metro Bank with no issues, and have only had trouble with the Lloyds Bank app as of an update from maybe 2-3 months ago which throws an error saying they've detected I'm using a jailbroken/rooted device

White_Wolf 3y ago
I get a message that the device is not secure but I can still make transfers and such from the banking app on a rooted OP9Pro. Never tried to use NFC payments though.
doublerabbit 3y ago
Try using Monzo or Sterling. Both will nail you to the ground.

baby_souffle 3y ago

> Do you use a banking app? Last I read depending on the type of check used some apps can still be problematic. It's important to distinguish between banking app and payment app. If you just want to check your account balance or find an ATM, the banking app will probably not mind that you're on a device that can't pass integrity checks. If you want to use your phone's NFC to pay for coffee, though, you're going to have a bad time.

Xfx7028 3y ago

I use N26, Revolut, ING, and others. No issues, I just add the apps I need to the magisk hide list. I also use NFC payments. Only Google wallet does not work.

didntcheck 3y ago

Also many "corporate" things, usually depending on your org's policy. E.g. I can't run OpsGenie (it may actually be the Microsoft SSO step failing, I'm not entirely sure, but the error definitely mentions my device not meeting security policies)