4 ms·

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app can examine your device in this much detail.

ajb 2y ago
You could try getting them to give you a physical security key, they used to supply them and I think still will if you can't use the app (just say it doesn't work on your phone). I have one and the website still works with it.
- graemep 2y ago
  Thanks, I was thinking of phoning and asking, but good to know there is some point in waiting in the queue to talk to someone!
  - ajb 2y ago
    If you're near a branch you can also just pop in and ask for one; might be faster. I did that when the battery ran out on my last one. There's no process upfront, you then have to pair it with your account. Well,you will probably have to convince them to switch your account to use a physical key - maybe that means you have to call anyway, I don't know.
robertlagrant 2y ago
> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I was in a "dev mode" somehow, but that was very surprising.
- HeatrayEnjoyer 2y ago
  By default you can `ls` almost anything on an entire drive.
- liontwist 2y ago
  That is how it works. Apps on android and iOS can’t access data outside of their contsiner.
  - SpaghettiCthulu 2y ago
    Afaik all apps on android have the ability to list directories across most of the "sdcard" file system even without storage permissions.
    - TeMPOraL 2y ago
      Sure, but all the interesting data is stored in a subtree that mostly won't even show on that list. In fact, there doesn't seem to be a way for a user of non-rooted phone to view this data. This sucks.
      - JadeNB 2y ago
        Do you mean Android/data? This is accessible on a non-rooted device using Marc apps & software's "Files" https://play.google.com/store/apps/details?id=com.marc.files https://play.google.com/store/apps/details?id=com.marc.files (an easily accessible shortcut to the native Android file manager).
        TeMPOraL 2y ago
        It is - and there are other ways to make that shortcut appear even without an app. But that app also got nerfed some time ago, and in general, even when file managers can access Android/data, that folder is missing many subdirectories, and most of those that can be seen, are empty. For some reason, you can get at some more files and folders in this structure if you plug the phone to your PC (this is apparently intentional). But none of that gives you access to any of the interesting/useful data applications store, and then applications also have a special super-private folder elsewhere. You can learn that and more through an app like https://github.com/MuntashirAkon/AppManager https://github.com/MuntashirAkon/AppManager running in ADB over Wi-Fi mode (no-root).
ksp-atlas 2y ago
The app works for me just fine despite having lots of non-google play apps installed, is this an Android 15 thing?
- Mindwipe 2y ago
  It works fine for me on Android 15 with non-Google Play apps installed too.
1317 2y ago
It used to let you use it with a full-on rooted phone, it just popped up a message saying 'it's not our problem if you get robbed' i wonder what caused the change as others have said, you can ring them up and get a physical security key, it works for the website
- miki123211 2y ago
  > i wonder what caused the change In many countries, if the consumer gets defrauded, the bank foots the bill. I don't think the problem here is consumers getting defrauded by having an insecure rooted device. It's fraudsters using the mobile app APIs for nefarious purposes, and the best way to prevent that is to use SafetyNet and other similar mechanisms.
  - TeMPOraL 2y ago
    > and the best way to prevent that is to use SafetyNet and other similar mechanisms. It's not the best way to prevent it. It's the easiest way for the bank to avoid liability. The ugly truth of cybersecurity is that, in the real world, most of it is an exercise in shifting liability around and diffusing it. Making systems actually secure is not necessary.
- Mindwipe 2y ago
  The app works perfectly well on my device, parent comment is just mistaken.
  - 1317 2y ago
    I personally experienced the issue myself
gunian 2y ago
Kind of ironic since you can't easily export data as an end user without some friction
Mindwipe 2y ago
The HSBC UK app runs perfectly well on my Android phone, including full biometrics, 2FA for the website and for major functionality like transferring money. I have at least a dozen apps installed on my phone that are not from the Play Store - a mixture of other stores (Samsung/Epic) and apps that are not from any store but I've compiled myself, or downloaded APKs directly from the developer website. This isn't true.
White_Wolf 2y ago
The HSBC app runs fine on my rooted phone with a few magisk plugins and 5 marketplaces installed and a ton of sideloaded apps.
- graemep 2y ago
  It used to work on my old phone. Stopped with nee one. May depend on Android version or when you installed.
- deleted 2y ago
  [deleted]
jimjambw 2y ago
Do you happen to remember which bus company this was? Is there any article you can link me too as I’m quite interested in reading some more on it.
- graemep 2y ago
  I think it was Arriva. Defineitely one that operated in Manchester st the time. Cannot find a link.
  - RadiozRadioz 2y ago
    Yes it is Arriva. Independently I also extracted all the ticket codes when I was a kid.
    - jimjambw 2y ago
      Thanks both!
RadiozRadioz 2y ago
This is terrifying to me, and part of the reason I've kept the little authentication calculator instead of moving to the app. Also the app won't work on root and has a fairly narrow range of Android versions it's compatible with. I travel a lot and I would benefit from opening a "global money" account. However this requires the app, so I've never done it. If they ever drop support for the physical authentication calculator, I will move to a different bank that doesn't require an app. Which is increasingly difficult these days.

ajb 2y ago

You could try getting them to give you a physical security key, they used to supply them and I think still will if you can't use the app (just say it doesn't work on your phone). I have one and the website still works with it.

graemep 2y ago
Thanks, I was thinking of phoning and asking, but good to know there is some point in waiting in the queue to talk to someone!
- ajb 2y ago
  If you're near a branch you can also just pop in and ask for one; might be faster. I did that when the battery ran out on my last one. There's no process upfront, you then have to pair it with your account. Well,you will probably have to convince them to switch your account to use a physical key - maybe that means you have to call anyway, I don't know.

robertlagrant 2y ago

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I was in a "dev mode" somehow, but that was very surprising.

HeatrayEnjoyer 2y ago
By default you can `ls` almost anything on an entire drive.
liontwist 2y ago
That is how it works. Apps on android and iOS can’t access data outside of their contsiner.
- SpaghettiCthulu 2y ago
  Afaik all apps on android have the ability to list directories across most of the "sdcard" file system even without storage permissions.
  - TeMPOraL 2y ago
    Sure, but all the interesting data is stored in a subtree that mostly won't even show on that list. In fact, there doesn't seem to be a way for a user of non-rooted phone to view this data. This sucks.
    - JadeNB 2y ago
      Do you mean Android/data? This is accessible on a non-rooted device using Marc apps & software's "Files" https://play.google.com/store/apps/details?id=com.marc.files https://play.google.com/store/apps/details?id=com.marc.files (an easily accessible shortcut to the native Android file manager).
      - TeMPOraL 2y ago
        It is - and there are other ways to make that shortcut appear even without an app. But that app also got nerfed some time ago, and in general, even when file managers can access Android/data, that folder is missing many subdirectories, and most of those that can be seen, are empty. For some reason, you can get at some more files and folders in this structure if you plug the phone to your PC (this is apparently intentional). But none of that gives you access to any of the interesting/useful data applications store, and then applications also have a special super-private folder elsewhere. You can learn that and more through an app like https://github.com/MuntashirAkon/AppManager https://github.com/MuntashirAkon/AppManager running in ADB over Wi-Fi mode (no-root).

ksp-atlas 2y ago

The app works for me just fine despite having lots of non-google play apps installed, is this an Android 15 thing?

Mindwipe 2y ago
It works fine for me on Android 15 with non-Google Play apps installed too.

1317 2y ago

It used to let you use it with a full-on rooted phone, it just popped up a message saying 'it's not our problem if you get robbed' i wonder what caused the change as others have said, you can ring them up and get a physical security key, it works for the website

miki123211 2y ago
> i wonder what caused the change In many countries, if the consumer gets defrauded, the bank foots the bill. I don't think the problem here is consumers getting defrauded by having an insecure rooted device. It's fraudsters using the mobile app APIs for nefarious purposes, and the best way to prevent that is to use SafetyNet and other similar mechanisms.
- TeMPOraL 2y ago
  > and the best way to prevent that is to use SafetyNet and other similar mechanisms. It's not the best way to prevent it. It's the easiest way for the bank to avoid liability. The ugly truth of cybersecurity is that, in the real world, most of it is an exercise in shifting liability around and diffusing it. Making systems actually secure is not necessary.
Mindwipe 2y ago
The app works perfectly well on my device, parent comment is just mistaken.
- 1317 2y ago
  I personally experienced the issue myself

gunian 2y ago

Kind of ironic since you can't easily export data as an end user without some friction

Mindwipe 2y ago

The HSBC UK app runs perfectly well on my Android phone, including full biometrics, 2FA for the website and for major functionality like transferring money. I have at least a dozen apps installed on my phone that are not from the Play Store - a mixture of other stores (Samsung/Epic) and apps that are not from any store but I've compiled myself, or downloaded APKs directly from the developer website. This isn't true.

White_Wolf 2y ago

The HSBC app runs fine on my rooted phone with a few magisk plugins and 5 marketplaces installed and a ton of sideloaded apps.

graemep 2y ago
It used to work on my old phone. Stopped with nee one. May depend on Android version or when you installed.
deleted 2y ago
[deleted]

jimjambw 2y ago

Do you happen to remember which bus company this was? Is there any article you can link me too as I’m quite interested in reading some more on it.

graemep 2y ago
I think it was Arriva. Defineitely one that operated in Manchester st the time. Cannot find a link.
- RadiozRadioz 2y ago
  Yes it is Arriva. Independently I also extracted all the ticket codes when I was a kid.
  - jimjambw 2y ago
    Thanks both!

RadiozRadioz 2y ago

This is terrifying to me, and part of the reason I've kept the little authentication calculator instead of moving to the app. Also the app won't work on root and has a fairly narrow range of Android versions it's compatible with. I travel a lot and I would benefit from opening a "global money" account. However this requires the app, so I've never done it. If they ever drop support for the physical authentication calculator, I will move to a different bank that doesn't require an app. Which is increasingly difficult these days.