8 ms·

> It's mind boggingly stupid that they lock down apps like this, when you can just open the thing in a website anyway. I can use my bank on some linux distro...

by fodmap 8mo ago

> It's mind boggingly stupid that they lock down apps like this, when you can just open the thing in a website anyway. I can use my bank on some linux distro... Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I have several linux phones but I can only do banking with their app downloaded from Aurora Store in my Vollaphone.

b112 8mo ago
Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I've seen this elsewhere, and it's absolutely ridiculous. Why? Because in almost all cases, the apps may only be installed with Google Play, and require the framework to work correctly. And that means? If you are not in good standing with Google, you cannot bank!! I cannot stress how inane it is, to have Google or Apple as the gatekeeping to identify verification. How not having an active, in good standing account with one of these two, means you cannot bank. And it's happening more and more. Meanwhile, banks -- which tend to make billions in profits quarterly, do this to save on infrastructure costs. They do it so they don't have to stand up their own push servers, or have an app which doesn't require firebase. Well cry me a river, boo-hoo Mr Banker, I'm not even remotely interested in you saving on infra-structure costs at the loss of autonomy. And on top of this, many banks are reducing hours, closing branches, claiming that they don't need them. Leaving absolutely no other choice. This sort of thing should be illegal. Being in Spain, but requiring a US megacorp to tell your own bank, that you're you.
- bergheim 8mo ago
  Especially with how things are currently, I whole heartedly agree - you cannot operate as a human being in Europe without having a good standing with either Alphabet or Apple. Absolute madness.
  - 6LLvveMx2koXfwn 8mo ago
    Absolute madness or complete nonsense - I have neither an Apple account or device, nor a Google account or mandated device (e/os on Fairphone 3+) and operate perfectly successfully in the UK with (almost [1.]) zero friction. 1. Revolut app stopped working so I emptied my account and opened a Wise account which is fully administer-able from their website. Revolut has subsequently started working again after a couple of app/OS updates.
    - notpushkin 8mo ago
      > Revolut app stopped working so I emptied my account and opened a Wise account Same, though I’ve never returned to Revolut. Wise does have some quirks (e.g. they’ve blocked me from unfreezing or reissuing my cards recently for no apparent reason), but still they’re way way closer to zero-bullshit than any other neobanks I’ve tried.
- FullMetalBitch 8mo ago
  Why? Technofeudalism is not going to impose itself
- vladms 8mo ago
  As far as I remember, last time I needed to use Google play on a shared phone I could just create a random Google address (I mean, completely invented name, etc.) and it allowed me to do anything, just as my normal Android. I am too lazy to test, but did this change? Can't you just make a "fake" account and continue with your life? The phone company knows where you are, the bank knows what you purchase. Compared to that Google will know far less (ofc, if you don't activate everything) I find it much more insane that it was possible for so long to do banking WITHOUT strong authentication (however implemented) by just providing those 3 numbers on the back of the card (strong security!)
  - ImPostingOnHN 8mo ago
    No, they will either immediately or shortly thereafter require you to link a phone number, etc
    - vladms 8mo ago
      The original comment was saying: > If you are not in good standing with Google, you cannot bank!! > I cannot stress how inane it is, to have Google or Apple as the gatekeeping to identify verification. How not having an active, in good standing account with one of these two, means you cannot bank. Having to register some phone number (does not need to be your main number, a sim card is quite cheap) to a "fake/unused" email address (even if as you say you are required yo) does not require you to "be in good standing with Google" and they are not gatekeepers of identity. At this point in time I feel the banks and the mobile phone operators are much worse managers of identity, because, for example they even accept stolen identifiers to make an account in "your name" - for me that's more ridiculous, not that they require some multiple factor of authentication.
      - deleted 8mo ago
        [deleted]
    - tranq_cassowary 8mo ago
      You can create a Google account without adding a phone number, that's still possible currently. To do this you need to make it within an app, for example Google Play Store or YouTube, not on the websites. You also need to use a trusted IP, so you shouldn't use a VPN. To avoid handing out your home WiFi IP, you can use a public WiFi point or use cellular which cycles IPs more quickly.
- bytejanitor 8mo ago
  In Germany for some banks you can buy a TAN generator and then you do not need a smartphone app anymore. Is this an option in your area as well?
  - noAnswer 8mo ago
    At my "traditional" bank I even need the TAN generator for my phone. While at my "neo" bank I even need the phone app to access the website. :-) (That is how the neo bank tricked me. I read "website access" in their ad and thought I could still access the bank account if I lose my phone. But no, you can't login without the app.)
- afpx 8mo ago
  I thought this was what Larry meant when he said surveillance will keep citizens on their best behavior. If one’s reputation score is low, sorry no money. Also, if anyone in one’s network has bad behavior, no money and no friends. Maybe the kids will learn to accept it, but being of the last analog generation, to me it seems like a painful future.
- jlokier 8mo ago
  > They do it so they don't have to stand up their own push servers I don't agree with this dependency on being in good standing with Google either. But there is a technical reason that isn't wanting to avoid using their push servers. It is about battery usage and radio bandwidth. Keeping open an idle connection over WebSocket, long-poll HTTP or TCP/IP needs regular pings (typically 30 seconds are used), one ping per connection. Otherwise your app can't be sure to receive messages from the server in real time, as the connection can disappear into CGNAT or similar hole where it doesn't receive messages sent by the server. To an app not using pings to check, such a blackholed connection is indisinguishable from an idle connection with no pending messages. Waking the radio every 30 seconds, times 2 (back and forth), times the number of registered applications, would be quite battery draining. It drains battery both for background CPU usage and radio processing. Those pings in aggregate can even amount to a significant amount of data usage for users on smaller plans. So there is a battery and radio advantage in using a shared push service, which only need a single idle connection to be kept live with 30 second pings. There's another level to this, not available to regular developers using TCP/IP, HTTP or WebSockets. The mobile network itself has to maintain handset connection liveness to the nearest tower, at a lower level than IP pings, and this is obviously optimised for battery and radio performance, and always running. With arrangements in place with the mobile networks (which Google and Apple have), the mobile OS can leverage that for more reliable, lower power push notifications, by either guaranteeing the network will send something technically similar to a low-level SMS when there's an outstanding message, or by guaranteeing their special push IP connection will stay live by itself (no CGNAT blackhole) or be notified if something happens to it. This allows the mobile OS to offer a shared push service that's fairly reliable at real-time notifications, with zero continuous CPU and radio power overhead for the idle connection.
  - dotancohen 8mo ago
    Why does a banking app that I'm not currently using need to ping a server occasionally? When I want to do banking I'll open the app, do my business, then close the app. A banking application does not need push notifications.
    - 8mo ago
- derbOac 8mo ago
  It seems like the right time to advocate for open standards in things like banking.
FullMetalBitch 8mo ago
I have been using GrapheneOS for a few months in Spain with and out of three banking apps only one gave me trouble, I had to enable "Exploit Protection Compatibility Mode" on "app information". Personally I refuse to pay with the phone so I am okay not having that option. If someone wants to try Graphene os maybe that option will work on their banks too.
Tharre 8mo ago
> Not in Spain. I can access my bank's website but I can't do anything without their bank app. I don't know about Spain specifically, but as far as I understand it no bank in the European Economic Area + UK should allow banking via just the website alone anymore, because of the "Revised Payment Services Directive" (PSD2) regulation. Essentially, banks are required to implement "strong customer authentication", which in essence is just multi-factor authentication with a password + either biometrics or a security device of some sort. And in practise that means a banking app, because most people do not want a separate token they have to buy and can lose. Though a lot of banks do offer those as well.
- askonomm 8mo ago
  In Estonia you can easily do banking via the website on all the banks (LHV, Swedbank, SEB). That said, we do have it all integrated with our digital-ID (which every ID card has private keys encoded into with a PIN you know) so it's not like you can access it with a simple password (our online voting works the same way).
  - edoceo 8mo ago
    Can the PIN change? How to issue new key if needed? How does it integrate with the voting?
    - notpushkin 8mo ago
      > Can the PIN change? You can change it in the app, yes. > How to issue new key if needed? I think you’ll have to reissue your ID. There’s also digi-ID (similar e-signature certificate on a card, but without any ID features), Mobiil-ID (e-signature on a SIM-card, no idea how it works), Smart-ID (in app, tied to secure storage in Android/iOS, cross-signed by the server which is supposed to check the device somehow) and probably something else I don’t remember. All of these are independent options, so you can, for example, revoke your Mobiil-ID if you lose your phone, and still use the your main ID card to sign things.
      - 8mo ago
shevy-java 8mo ago
This should be illegal that the government forces people into apps controlled by private, commercial entities. I call such a government corrupt. Here in central Europe I can still access the bank website fine without smartphone. I need a physical device to yield a TAN though, but I can access and do online transactions fine. So I think something is wrong with the spanish government. People need to protest.
- phantom784 8mo ago
  Especially in Europe! They shouldn't be forcing you to run an OS from an American company.
  - wolvoleo 8mo ago
    Even the EU initiative Wero requires Google or Apple. You can't even use it on a desktop pc and you're not even allowed to have developer options on. Ridiculous. I've never seen any app that is so strict.
    - rahkiin 8mo ago
      Weird, because Wero is an internationalization of the dutch iDeal and that worked fine without any apps. You clicked ‘continue to bank’, select your bank, and then login on the bank web portal.
    - kyusan0 8mo ago
      That's not exactly right, Wero the app is not Wero the payment system. Banks and payment processors are expected to integrate Wero the same way they do with iDeal and similar systems. So ultimately if your bank's app doesn't require attestation you will be able to use Wero through it.
  - wcallahan 8mo ago
    American here who values individual liberties greatly. I know things are politically tense at the moment, but I’m not sure I understand this popular contemporary sentiment. I’ve always believed governments and companies should be regarded with fairly low trust, and the behavior of big tech companies and some recent government actions are great examples why. But what disappoints me a bit about this moment is (the perhaps inevitable?) response to nationalism with more nationalism. Just as I didn’t seek to punish the EU over authoritarianism in Hungary and Poland, I feel the current moment has many responding to the symptoms instead of the sources of the problems. This is not a defense of policies I believe concern you, it’s a question of priorities. I think the author of the article got it right. Because in addition to privacy, I believe one should be able to navigate the internet freely without a mandate to do business with monopolistic dominant companies, which includes rights like ownership of your data.
lejalv 8mo ago
> Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. https://triodos.es https://triodos.es has 2FA via SMS, for what is worth.
- fodmap 8mo ago
  My bank used to have it as well but not anymore. I wonder for how long Triodos will be able to keep that option.
severino 8mo ago
I don't know which banks you are using but in my case I work with five Spanish banks and I can do everything from their websites, no app required. Yes, they try to push you to use their app, some tried to activate mobile 2fa for me when this psd2 thing became mandatory but I always told them their app doesn't work on my phone (which is true) and they offered me alternate methods like sms.
- dotancohen 8mo ago
  In my country we have a large religious population who eschew the smartphone. This means that no government, banking, or other services require a smartphone.
- fodmap 8mo ago
  Can you access their websites without the need to confirm 'who you are' with their app? In my case, not anymore. My bank used to have other options but it has made mandatory the use of their app.
  - severino 8mo ago
    > Can you access their websites without the need to confirm 'who you are' with their app? Yes, none of them required me to use the app a single time. In fact, for all the banks I work with, I always identified myself at a local office when opening the account for the first time, the last one less than a year ago. And all of them allow me to operate in the website without the need of an app (actually I could never use any banking app as my telephone lacks Google Play).
abdullahkhalids 8mo ago
Similar in Canada. - RBC 2FA is that if I try to login through my browser, the phone app will ask if I authorize the login. I think I can disable this and use sms/call, but that's even more insecure, so I don't. - TD lets me login fine and do everything in the browser. But any online transaction that is moderately large or presumably fishy, will force me to authorize the transaction via the app. These are among the largest banks in Canada.
rglynn 8mo ago
Other than the inconvenience, is there any privacy risk in just having a separate device purely for those apps and nothing else? Or is it more of a principle to resist this being forced on us?

by fodmap 8mo ago

b112 8mo ago

Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. I've seen this elsewhere, and it's absolutely ridiculous. Why? Because in almost all cases, the apps may only be installed with Google Play, and require the framework to work correctly. And that means? If you are not in good standing with Google, you cannot bank!! I cannot stress how inane it is, to have Google or Apple as the gatekeeping to identify verification. How not having an active, in good standing account with one of these two, means you cannot bank. And it's happening more and more. Meanwhile, banks -- which tend to make billions in profits quarterly, do this to save on infrastructure costs. They do it so they don't have to stand up their own push servers, or have an app which doesn't require firebase. Well cry me a river, boo-hoo Mr Banker, I'm not even remotely interested in you saving on infra-structure costs at the loss of autonomy. And on top of this, many banks are reducing hours, closing branches, claiming that they don't need them. Leaving absolutely no other choice. This sort of thing should be illegal. Being in Spain, but requiring a US megacorp to tell your own bank, that you're you.

bergheim 8mo ago
Especially with how things are currently, I whole heartedly agree - you cannot operate as a human being in Europe without having a good standing with either Alphabet or Apple. Absolute madness.
- 6LLvveMx2koXfwn 8mo ago
  Absolute madness or complete nonsense - I have neither an Apple account or device, nor a Google account or mandated device (e/os on Fairphone 3+) and operate perfectly successfully in the UK with (almost [1.]) zero friction. 1. Revolut app stopped working so I emptied my account and opened a Wise account which is fully administer-able from their website. Revolut has subsequently started working again after a couple of app/OS updates.
  - notpushkin 8mo ago
    > Revolut app stopped working so I emptied my account and opened a Wise account Same, though I’ve never returned to Revolut. Wise does have some quirks (e.g. they’ve blocked me from unfreezing or reissuing my cards recently for no apparent reason), but still they’re way way closer to zero-bullshit than any other neobanks I’ve tried.
FullMetalBitch 8mo ago
Why? Technofeudalism is not going to impose itself
vladms 8mo ago
As far as I remember, last time I needed to use Google play on a shared phone I could just create a random Google address (I mean, completely invented name, etc.) and it allowed me to do anything, just as my normal Android. I am too lazy to test, but did this change? Can't you just make a "fake" account and continue with your life? The phone company knows where you are, the bank knows what you purchase. Compared to that Google will know far less (ofc, if you don't activate everything) I find it much more insane that it was possible for so long to do banking WITHOUT strong authentication (however implemented) by just providing those 3 numbers on the back of the card (strong security!)
- ImPostingOnHN 8mo ago
  No, they will either immediately or shortly thereafter require you to link a phone number, etc
  - vladms 8mo ago
    The original comment was saying: > If you are not in good standing with Google, you cannot bank!! > I cannot stress how inane it is, to have Google or Apple as the gatekeeping to identify verification. How not having an active, in good standing account with one of these two, means you cannot bank. Having to register some phone number (does not need to be your main number, a sim card is quite cheap) to a "fake/unused" email address (even if as you say you are required yo) does not require you to "be in good standing with Google" and they are not gatekeepers of identity. At this point in time I feel the banks and the mobile phone operators are much worse managers of identity, because, for example they even accept stolen identifiers to make an account in "your name" - for me that's more ridiculous, not that they require some multiple factor of authentication.
    - deleted 8mo ago
      [deleted]
  - tranq_cassowary 8mo ago
    You can create a Google account without adding a phone number, that's still possible currently. To do this you need to make it within an app, for example Google Play Store or YouTube, not on the websites. You also need to use a trusted IP, so you shouldn't use a VPN. To avoid handing out your home WiFi IP, you can use a public WiFi point or use cellular which cycles IPs more quickly.
bytejanitor 8mo ago
In Germany for some banks you can buy a TAN generator and then you do not need a smartphone app anymore. Is this an option in your area as well?
- noAnswer 8mo ago
  At my "traditional" bank I even need the TAN generator for my phone. While at my "neo" bank I even need the phone app to access the website. :-) (That is how the neo bank tricked me. I read "website access" in their ad and thought I could still access the bank account if I lose my phone. But no, you can't login without the app.)
afpx 8mo ago
I thought this was what Larry meant when he said surveillance will keep citizens on their best behavior. If one’s reputation score is low, sorry no money. Also, if anyone in one’s network has bad behavior, no money and no friends. Maybe the kids will learn to accept it, but being of the last analog generation, to me it seems like a painful future.
jlokier 8mo ago
> They do it so they don't have to stand up their own push servers I don't agree with this dependency on being in good standing with Google either. But there is a technical reason that isn't wanting to avoid using their push servers. It is about battery usage and radio bandwidth. Keeping open an idle connection over WebSocket, long-poll HTTP or TCP/IP needs regular pings (typically 30 seconds are used), one ping per connection. Otherwise your app can't be sure to receive messages from the server in real time, as the connection can disappear into CGNAT or similar hole where it doesn't receive messages sent by the server. To an app not using pings to check, such a blackholed connection is indisinguishable from an idle connection with no pending messages. Waking the radio every 30 seconds, times 2 (back and forth), times the number of registered applications, would be quite battery draining. It drains battery both for background CPU usage and radio processing. Those pings in aggregate can even amount to a significant amount of data usage for users on smaller plans. So there is a battery and radio advantage in using a shared push service, which only need a single idle connection to be kept live with 30 second pings. There's another level to this, not available to regular developers using TCP/IP, HTTP or WebSockets. The mobile network itself has to maintain handset connection liveness to the nearest tower, at a lower level than IP pings, and this is obviously optimised for battery and radio performance, and always running. With arrangements in place with the mobile networks (which Google and Apple have), the mobile OS can leverage that for more reliable, lower power push notifications, by either guaranteeing the network will send something technically similar to a low-level SMS when there's an outstanding message, or by guaranteeing their special push IP connection will stay live by itself (no CGNAT blackhole) or be notified if something happens to it. This allows the mobile OS to offer a shared push service that's fairly reliable at real-time notifications, with zero continuous CPU and radio power overhead for the idle connection.
- dotancohen 8mo ago
  Why does a banking app that I'm not currently using need to ping a server occasionally? When I want to do banking I'll open the app, do my business, then close the app. A banking application does not need push notifications.
  - 8mo ago
derbOac 8mo ago
It seems like the right time to advocate for open standards in things like banking.

FullMetalBitch 8mo ago

I have been using GrapheneOS for a few months in Spain with and out of three banking apps only one gave me trouble, I had to enable "Exploit Protection Compatibility Mode" on "app information". Personally I refuse to pay with the phone so I am okay not having that option. If someone wants to try Graphene os maybe that option will work on their banks too.

Tharre 8mo ago

> Not in Spain. I can access my bank's website but I can't do anything without their bank app. I don't know about Spain specifically, but as far as I understand it no bank in the European Economic Area + UK should allow banking via just the website alone anymore, because of the "Revised Payment Services Directive" (PSD2) regulation. Essentially, banks are required to implement "strong customer authentication", which in essence is just multi-factor authentication with a password + either biometrics or a security device of some sort. And in practise that means a banking app, because most people do not want a separate token they have to buy and can lose. Though a lot of banks do offer those as well.

askonomm 8mo ago
In Estonia you can easily do banking via the website on all the banks (LHV, Swedbank, SEB). That said, we do have it all integrated with our digital-ID (which every ID card has private keys encoded into with a PIN you know) so it's not like you can access it with a simple password (our online voting works the same way).
- edoceo 8mo ago
  Can the PIN change? How to issue new key if needed? How does it integrate with the voting?
  - notpushkin 8mo ago
    > Can the PIN change? You can change it in the app, yes. > How to issue new key if needed? I think you’ll have to reissue your ID. There’s also digi-ID (similar e-signature certificate on a card, but without any ID features), Mobiil-ID (e-signature on a SIM-card, no idea how it works), Smart-ID (in app, tied to secure storage in Android/iOS, cross-signed by the server which is supposed to check the device somehow) and probably something else I don’t remember. All of these are independent options, so you can, for example, revoke your Mobiil-ID if you lose your phone, and still use the your main ID card to sign things.
    - 8mo ago

shevy-java 8mo ago

This should be illegal that the government forces people into apps controlled by private, commercial entities. I call such a government corrupt. Here in central Europe I can still access the bank website fine without smartphone. I need a physical device to yield a TAN though, but I can access and do online transactions fine. So I think something is wrong with the spanish government. People need to protest.

phantom784 8mo ago
Especially in Europe! They shouldn't be forcing you to run an OS from an American company.
- wolvoleo 8mo ago
  Even the EU initiative Wero requires Google or Apple. You can't even use it on a desktop pc and you're not even allowed to have developer options on. Ridiculous. I've never seen any app that is so strict.
  - rahkiin 8mo ago
    Weird, because Wero is an internationalization of the dutch iDeal and that worked fine without any apps. You clicked ‘continue to bank’, select your bank, and then login on the bank web portal.
  - kyusan0 8mo ago
    That's not exactly right, Wero the app is not Wero the payment system. Banks and payment processors are expected to integrate Wero the same way they do with iDeal and similar systems. So ultimately if your bank's app doesn't require attestation you will be able to use Wero through it.
- wcallahan 8mo ago
  American here who values individual liberties greatly. I know things are politically tense at the moment, but I’m not sure I understand this popular contemporary sentiment. I’ve always believed governments and companies should be regarded with fairly low trust, and the behavior of big tech companies and some recent government actions are great examples why. But what disappoints me a bit about this moment is (the perhaps inevitable?) response to nationalism with more nationalism. Just as I didn’t seek to punish the EU over authoritarianism in Hungary and Poland, I feel the current moment has many responding to the symptoms instead of the sources of the problems. This is not a defense of policies I believe concern you, it’s a question of priorities. I think the author of the article got it right. Because in addition to privacy, I believe one should be able to navigate the internet freely without a mandate to do business with monopolistic dominant companies, which includes rights like ownership of your data.

lejalv 8mo ago

> Not in Spain. I can access my bank's website but I can't do anything without their bank app. Even sometimes they require to confirm my identity using their app in order to access their website. https://triodos.es https://triodos.es has 2FA via SMS, for what is worth.

fodmap 8mo ago
My bank used to have it as well but not anymore. I wonder for how long Triodos will be able to keep that option.

severino 8mo ago

I don't know which banks you are using but in my case I work with five Spanish banks and I can do everything from their websites, no app required. Yes, they try to push you to use their app, some tried to activate mobile 2fa for me when this psd2 thing became mandatory but I always told them their app doesn't work on my phone (which is true) and they offered me alternate methods like sms.

dotancohen 8mo ago
In my country we have a large religious population who eschew the smartphone. This means that no government, banking, or other services require a smartphone.
fodmap 8mo ago
Can you access their websites without the need to confirm 'who you are' with their app? In my case, not anymore. My bank used to have other options but it has made mandatory the use of their app.
- severino 8mo ago
  > Can you access their websites without the need to confirm 'who you are' with their app? Yes, none of them required me to use the app a single time. In fact, for all the banks I work with, I always identified myself at a local office when opening the account for the first time, the last one less than a year ago. And all of them allow me to operate in the website without the need of an app (actually I could never use any banking app as my telephone lacks Google Play).

abdullahkhalids 8mo ago

Similar in Canada. - RBC 2FA is that if I try to login through my browser, the phone app will ask if I authorize the login. I think I can disable this and use sms/call, but that's even more insecure, so I don't. - TD lets me login fine and do everything in the browser. But any online transaction that is moderately large or presumably fishy, will force me to authorize the transaction via the app. These are among the largest banks in Canada.

rglynn 8mo ago

Other than the inconvenience, is there any privacy risk in just having a separate device purely for those apps and nothing else? Or is it more of a principle to resist this being forced on us?