5 ms·
The HSBC app refuses to work if "Bitwarden" is installed on user's Android phone
- fortran77 10mo agoI think it may be because of a sideloaded app. That does seem like a more reasonable thing to warn about.
- wryoak 10mo agoWarn? Yes. Refuse access? No. I would close my bank account over this. That’s not saying much though because they literally pay you to open new bank accounts these days…
- walthamstow 10mo agoIf you cared even slightly about the app, you wouldn't have a HSBC account anyway, you'd have Starling or Monzo or maybe Revolut
- wolvoleo 10mo agoMost banks now require their app for MFA for payments, sadly. They used to offer these "calculator" devices but most banks I know of in my country now require their app. Which sucks for me because I don't want to have my authenticator on a hackable internet-connected device.
- vrighter 10mo agoand as soon as you login to their app once, that other key gets invalidated. It took weeks to convince them to switch me back to that key because they couldn't understand the concept that their app refused to run on my phone
- wolvoleo 10mo agoYeah here they just sent an email "from <date> onwards all verificators are revoked, from now on you must use the app" :(
- tim333 10mo agoIf the sideloaded app manages to hack HSBC and steal the customers money they are going to have a demand to refund the customer a bunch of money. I can understand their position.
- protimewaster 10mo agoI understand that, but the thing I've never understood is that banking apps only care about meaningless measurements like whether a device passes Play Integrity. I have a tablet that passes Play Integrity but is also over 6 years behind on security updates. That device should not be allowed to run banking apps. Why not refuse to run on devices that don't have current security updates? How useful is Play Integrity actually for avoiding these types of problems?
- wolvoleo 10mo agoYes the problem is when all banks start doing this BS though.
- unixhero 10mo agoThis is a freedom we have on Android
- JumpCrisscross 10mo agoPrevious discussion: https://news.ycombinator.com/item?id=46431453 https://news.ycombinator.com/item?id=46431453
- jqpabc123 10mo agowhy does Google even allow HSBC to see the list of other installed apps? Maybe because Google and it's products have little respect for user privacy? Have you thought about using Aurora Store? You can usually see a list of the permissions the app requires before you install.
- mindcrash 10mo agoMaybe because Google and it's products have little respect for user privacy? That's incorrect. Querying installed apps has been severely restricted (and thus mostly useless) and also requires a special nuclear-scale permission since Android 11. I am wondering what exploit HSBC is using because I really don't think they are using official APIs for this.
- jqpabc123 10mo agoI am wondering what exploit HSBC is using Why was querying installed apps ever allowed? Why is an exploit or permission available now? Answer --- see the original post above.
- SpicyLemonZest 10mo agoYou don’t think your phone should let you run certain programs, even with elevated permissions?
- jqpabc123 10mo agoWere elevated permissions granted by the user in this case? If so, then this entire discussion is baseless.
- mindslight 10mo agoSure, but framed that way you also need to be able to run programs that think they have higher permissions even though API calls are returning mocked/sanitized data. And more generally, the ability to run programs with high permissions that can completely modify the behavior of other lower-permissions programs (eg HSBC).
- burnt-resistor 10mo agoIt only works when narco-trafficking money laundering apps are installed. That's why it doesn't work.
- vrighter 10mo agomine doesn't work because of kde connect, and an open source keybooard i slightly modified and rebuilt myself
- parlortricks 10mo agoWhat keyboard did you modify and why?
- vrighter 10mo agoI use a keyboard called PentiKeyboard. It's a chorded keyboard. It allows you to place 6 buttons (shown in outlines) overlaid on top of the whole screen. It had 2 features I wanted to remove. If you swipe in empty space, you can use it to adjust the screen brightness. I kept triggering this accidentally and each time it disabled auto-dimming on the system. And the other feature is that when the keyboard is open, the volume buttons are repurposed, I wanted them to remain working normally.