3 ms·

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your b

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your banking apps without first removing all of those... We need alternatives, this will not work and is a risk to freedom/democracy for all of us. Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. However Google and Apple can just remove it, what then? [1] https://github.com/swiyu-admin-ch https://github.com/swiyu-admin-ch

nake89 11mo ago
They won’t remove it if its been installed from their app stores.
- sschueller 11mo ago
  They removed the "ICE" app and if the US government has an issue with other Apps they bend over and do it. Switzerland is currently dealing with a 39% and Brazil with a 50% tariff because Trump has a personal problem with them. It would not be far fetched for an administration to have another states app removed.
  - nake89 11mo ago
    I just want to preface that I am not in support of Apple or Google in their closed ecosystem. I was specifically referring to you saying "Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. However Google and Apple can just remove it, what then?" It seemed like you were saying that because it is open source, it will be removed. I simply disagreed with that. Plenty of opensource software exists in the app store. I'm not disagreeing that they have the ability to remove software from their app stores. They have done that before as you mention. That is a fact.
    - sschueller 11mo ago
      > It seemed like you were saying that because it is open source, it will be removed. I simply disagreed with that. Plenty of opensource software exists in the app store. Sorry if it came across that way. It is not what I meant, I just mentioned that it is open source. ESL...
phendrenad2 11mo ago
Of course, it wouldn't be HN if the previous claim that "the sky is falling" wasn't followed up with "well, it's not falling, but I saw some heavy rainfall!"
rbits 11mo ago
Why do you think that will happen?
- concinds 11mo ago
  Paranoia.
  - sschueller 11mo ago
    The current US administration is not acting with logic nor reason. Switzerland is currently dealing with a 39% tariff for no reason. We are the 7th largest investor[1] in the United States with thousands of jobs and we are the worlds 3rd largest holder of US dollars[2]. [1] https://globalbusiness.org/foreign-direct-investment-in-the-united-states-2025/ https://globalbusiness.org/foreign-direct-investment-in-the-... [2] https://en.wikipedia.org/wiki/List_of_countries_by_foreign_exchange_reserves https://en.wikipedia.org/wiki/List_of_countries_by_foreign_e...
Llamamoe 11mo ago
Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.
- sschueller 11mo ago
  Insurance, they don't want to be on the hook if you get robbed.
- archon810 11mo ago
  Probably because it makes it easier to observe and/or intercept API calls and other data exchange between the client and the server. It's trivial to disable things like SSL cert pinning, etc. on rooted devices.
  - emsixteen 11mo ago
    … and then the return argument is that those who actually want to do this nefariously are already going to be able to hide device modifications/rooting.
- Elfener 11mo ago
  It may not be banks themselves doing this. For example, my bank here in Hungary, Erste Bank has announced that the central bank requested that they stop allowing their android app to run on "modified" devices. They even have a workaround: switch to SMS-based 2FA and use their website (which works well on any screen and has all the features of the app except 2FA)
  - groestl 11mo ago
    > the central bank requested That's the answer, it's regulatory bodies causing this.
    - BoredPositron 11mo ago
sureglymop 11mo ago
Is the digital ID just to identify yourself online? Because I've never had to do that. Kind of seems like a solution in search of a problem.
- sschueller 11mo ago
  The digital ID e.g. eID is for example if you want to order a government document online. At the current time you need to print out your request and send a copy of your ID in the mail or go to the counter and show it. Same if you get a bank account or new phone contract although those usually let you scan your ID with your phone. A eID would make that more secure although people are already being tricked into doing face validations[1]... Offline it would make it possible to verify your age at the self-checkout registers without having someone have to check in person. In the future (if the law allows it, which it currently does not) it should be possible for you to purchase an item online completely anonymously, at least to the vendor. There would no longer be a possibility of leaked address, etc. as the vendor would not have it. All the vendor has are signed tokens. When they send a package they send it with a token to the post office and only the post office knows your address. [1] https://www.srf.ch/sendungen/kassensturz-espresso/espresso/money-mule-masche-kriminelle-machen-unwissende-zu-geldwaeschern https://www.srf.ch/sendungen/kassensturz-espresso/espresso/m...
andyjohnson0 11mo ago
> They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. Sincere question: do you have any evidence for this? I don't see anything in the article that backs it up, and your asserion seems to be at odds with the description of a side load capability for "risk tolerant" users. What you describe would certainly break much of the usefulness of side loading for me. I certainly don't trust Google, or underestimate their capacity for duplicity. I'm just not sure about the outcome you describe.
- hasperdi 11mo ago
  It a projection of what they could do. ie. logical step The whole SafetyNet and "secure chain" things are PITA, eg. ChatGPT app wouldn't work if the phone bootloader isn't signed by Google. Lots of banking app wouldn't work, HSBC banking app for instance wouldn't allow login if Android developer mode is enabled.
  - consp 11mo ago
    Some apps do this because of some minor audit crap with relation to screenshots (the devmode part) afaik. Others just always blank the screen image and tell the auditor to [insert crude metaphor]. Same none sense with root enabled. You must have a check, doesn't specify which one and as long as you can show it works once you are fine.

nake89 11mo ago

They won’t remove it if its been installed from their app stores.

sschueller 11mo ago
They removed the "ICE" app and if the US government has an issue with other Apps they bend over and do it. Switzerland is currently dealing with a 39% and Brazil with a 50% tariff because Trump has a personal problem with them. It would not be far fetched for an administration to have another states app removed.
- nake89 11mo ago
  I just want to preface that I am not in support of Apple or Google in their closed ecosystem. I was specifically referring to you saying "Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. However Google and Apple can just remove it, what then?" It seemed like you were saying that because it is open source, it will be removed. I simply disagreed with that. Plenty of opensource software exists in the app store. I'm not disagreeing that they have the ability to remove software from their app stores. They have done that before as you mention. That is a fact.
  - sschueller 11mo ago
    > It seemed like you were saying that because it is open source, it will be removed. I simply disagreed with that. Plenty of opensource software exists in the app store. Sorry if it came across that way. It is not what I meant, I just mentioned that it is open source. ESL...

phendrenad2 11mo ago

Of course, it wouldn't be HN if the previous claim that "the sky is falling" wasn't followed up with "well, it's not falling, but I saw some heavy rainfall!"

rbits 11mo ago

Why do you think that will happen?

concinds 11mo ago
Paranoia.
- sschueller 11mo ago
  The current US administration is not acting with logic nor reason. Switzerland is currently dealing with a 39% tariff for no reason. We are the 7th largest investor[1] in the United States with thousands of jobs and we are the worlds 3rd largest holder of US dollars[2]. [1] https://globalbusiness.org/foreign-direct-investment-in-the-united-states-2025/ https://globalbusiness.org/foreign-direct-investment-in-the-... [2] https://en.wikipedia.org/wiki/List_of_countries_by_foreign_exchange_reserves https://en.wikipedia.org/wiki/List_of_countries_by_foreign_e...

Llamamoe 11mo ago

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

sschueller 11mo ago
Insurance, they don't want to be on the hook if you get robbed.
archon810 11mo ago
Probably because it makes it easier to observe and/or intercept API calls and other data exchange between the client and the server. It's trivial to disable things like SSL cert pinning, etc. on rooted devices.
- emsixteen 11mo ago
  … and then the return argument is that those who actually want to do this nefariously are already going to be able to hide device modifications/rooting.
Elfener 11mo ago
It may not be banks themselves doing this. For example, my bank here in Hungary, Erste Bank has announced that the central bank requested that they stop allowing their android app to run on "modified" devices. They even have a workaround: switch to SMS-based 2FA and use their website (which works well on any screen and has all the features of the app except 2FA)
- groestl 11mo ago
  > the central bank requested That's the answer, it's regulatory bodies causing this.
  - BoredPositron 11mo ago

sureglymop 11mo ago

Is the digital ID just to identify yourself online? Because I've never had to do that. Kind of seems like a solution in search of a problem.

sschueller 11mo ago
The digital ID e.g. eID is for example if you want to order a government document online. At the current time you need to print out your request and send a copy of your ID in the mail or go to the counter and show it. Same if you get a bank account or new phone contract although those usually let you scan your ID with your phone. A eID would make that more secure although people are already being tricked into doing face validations[1]... Offline it would make it possible to verify your age at the self-checkout registers without having someone have to check in person. In the future (if the law allows it, which it currently does not) it should be possible for you to purchase an item online completely anonymously, at least to the vendor. There would no longer be a possibility of leaked address, etc. as the vendor would not have it. All the vendor has are signed tokens. When they send a package they send it with a token to the post office and only the post office knows your address. [1] https://www.srf.ch/sendungen/kassensturz-espresso/espresso/money-mule-masche-kriminelle-machen-unwissende-zu-geldwaeschern https://www.srf.ch/sendungen/kassensturz-espresso/espresso/m...

andyjohnson0 11mo ago

> They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. Sincere question: do you have any evidence for this? I don't see anything in the article that backs it up, and your asserion seems to be at odds with the description of a side load capability for "risk tolerant" users. What you describe would certainly break much of the usefulness of side loading for me. I certainly don't trust Google, or underestimate their capacity for duplicity. I'm just not sure about the outcome you describe.

hasperdi 11mo ago
It a projection of what they could do. ie. logical step The whole SafetyNet and "secure chain" things are PITA, eg. ChatGPT app wouldn't work if the phone bootloader isn't signed by Google. Lots of banking app wouldn't work, HSBC banking app for instance wouldn't allow login if Android developer mode is enabled.
- consp 11mo ago
  Some apps do this because of some minor audit crap with relation to screenshots (the devmode part) afaik. Others just always blank the screen image and tell the auditor to [insert crude metaphor]. Same none sense with root enabled. You must have a check, doesn't specify which one and as long as you can show it works once you are fine.