454
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 29 Sep 2025
454 points (100.0% liked)
Android
32002 readers
194 users here now
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
founded 2 years ago
MODERATORS
Disclaimer: I have been a maintainer for LineageOS and a long time user.
Whoever advocates for LineageOS don't get it. Using LineageOS will not fix any issue like this.
Already today using LineageOS means give up on banking apps, ID apps, and even McDonald's and some games like Pokemon.
Yeah because Google with play intergrity now demands valid keys that gets invalidated as soon Google detect they are used for such usage. The cat and mouse game suddenly got much harder to beat.
So no, using LineageOS will soon be possible only with secondary devices and not your primary that you will need for your actual stuff to work.
Counterpoint: I use the McDonald's app where it belongs - on a giant greasy ordering kiosk.
But seriously, banks have websites. Everyone and everything has a website.
I don't need Android apps at the cost of my privacy or at the cost of control of my devices.
I use GrapheneOS as my only phone, and I have done so for years.
Whatever the topic, I don't need an app for that.
I don’t know about the US but on this side of the pond banks have their own 2nd factor apps. So to log in to a bank’s website you need an app - quite probably with play integrity.
That's insane, I have never heard of such a thing, but I'm in the US where most banks don't even have non-sms second factor.
In America, we're lucky if our bank supports 2fa, let alone require an app for it
That sounds extremely inconvenient. Individual apps for 2FA? No thanks. I'm good with KeePass and Aegis, both open source, encrypted, and don't require any extra hardware.
I've been using a dedicated TAN generator for banking since I first made my account but I don't doubt that's going away at some point, since debit cards from the same bank already require an app for 3-D secure.
No, hardware TAN generator work fine. If the bank wants to force me to use proprietary snake oil it's time for a new bank. Or using a dedicated old smartphone just for the app.
Dang. Y'all need to pick better credit unions. MFA rolling token is an open standard. Any single app can support all of my (correctly implemented) tokens. I prefer Aegis, but they (correctly implemented MFA apps) all work.
I don't want to trust my money to someone who can't implement standards compliant MFA.
That would scare the daylights out of me.
Well, they have a kind of 2FA since at least 30 years, long before rolling tokens were all over the place. Their latest implementations are as simple to use as Steam 2FA. If a bank isn’t able to implement a proper 2FA login there’s a ton of other security issues to worry about. Lastly, I think by using their own implementation/app they prevent their customers from using compromised apps.
Exactly. Any organization whose MFA doesn't work on Aegis, I take action to protect myself from their incompetence.
I'm sure they claim that. But I still recognize it as simple incompetence. They aren't able or willing to hire someone with the Cybersecurity expertise to implement a relatively simple open specification.
Y'all are welcome to risk your money there. It's probably insured anyway, right?
For me, that's too much risk. Even if insurance makes me whole, getting robbed is a huge pain.
That'll surely end their business. /s
Just out of curiosity: What percentage of the population is capable of running Graphene/Aegis? What percentage, regardless of capability, is willing to do so?
Creators of popular OSS regularly warn about downloading their stuff elsewhere or pay for it. How do you think that would apply to any 2FA application?
Now think of how stupid the average person is, and realize half of them are stupider than that. (love some George Carlin). Given that even (very) stupid people have and need bank accounts: How would you implement an authentication that can't easily be compromised to ripp off stupid people?*
* Let's just assume that you, the lead developer, are not at all "incompetent", quite the opposite. Also take into consideration that you need to keep cost down (hint: That means you want no one to call support because of 3rd party applications!).
This is actually a solved problem:
The credit union mplements (purchases from a competent vendor) their own custom branded standards compliant MFA solution.
This is what competent organizations already do.
Because the app is standards compliant, experts use Aegis instead of the branded app. Everyone else sticks with the branded app.
Also because the app is standards compliant, provided by a specialized vendor, and occasionally being used in unusual ways by expert users, serious security mistakes are much less likely to happen, and less likely to only be noticed by attackers.
I don't expect my credit union to tell me to use Aegis - I expect them to use a credible MFA vendor that interoperates correctly when I do use Aegis.
Counter-counterpoint:
Banks use their app to generate the otp and they reinvented the wheel so if you want to login you need to install it, can't use a generic authenticator. I am not aware of any single bank in the EU that allows the use of generic authenticators.
For McDonald's, using the app gives at least 50% off. A menu in the app costs 5 euro while on the store kiosk costs 12 euro. I do not personally care because I find their food to be just barely edible, but I understand why there's a need to install the app
Some people have no smartphone at all. How can they be customers at your bank?
My bank had a device that was basically a simple android phone running the 2fa app. The phone app got updated through new versions and eventually got the drm treatment, but the old app keeps working because it is still running on those dedicated 2fa "devices".
Naturally the bank is now trying their best to make people deregister the old "devices" and switch to only the "app".
The old app has no internet permissions. It reads qr from the camera and shows verification as a 6 digit code.
The new app has internet permissions and is integrated with other apps so you can conveniently accept the request of your banking app in the 2fa app (on the same phone) with a single tap via an overlay. 2fa.
That is incredibly stupid.
Wow, I admit that's reaally bad 😅
Also the norm tho, afaik
Pay a fee of 0.30€ to receive the otp via SMS every time they want to login without the proprietary otp app and 0.30€ for each payment to authorize
Fucking hell, y'all make me realize how lucky I am with my bank that runs without gapps.
I've never had an issue with the three banking apps I tried on LineageOS, and I didn't even know there was a McDonald's app or pokemon games.
If this list for /e/os roughly applies to LineageOS (with microG), I wouldn't call it "only for secondary devices", more "won't work for some people"
Did I miss something? AFAIK google is requiring devs to ID, not to use SafetyNet or whatever the "only-runs-on-certified-phones" thing is called
Same, my bank also doesn't require strict play integrity. I think I ran into an issue with a dating app once, but that's about it, and that's no real loss.
If my bank would suddenly stop working on Android with microG (with no simple alternative), I'd just switch to another bank, there are enough.
Exactly, trying to find software alternative for what ultimately going to be locked down hardware is never going to be a sustainable solution.
Alternative OS means nothing if there's no widely supported open hardware with unlocked bootloader to run such OS long term, and Google is got all mainstream phone manufactures cornered legally and commercially with this and their requirement for manufecturer authorization for shipping GMS suite with their products.
The only way out is this ridiculous decision of Google getting push backs from legislation, because there's nothing manufecturers can do and without them there's nothing FOSS developers can do to push back long term, and Google isn't stopping themselves from doing Evil™.
Fully agree
I (for the moment) use stock android without a google account without any issues.
Then again i don't use banking apps on a smartphone.
My gov provides ID apps and they work fine - then again, GPS is installed of course.
Fuck McDonnalds.
I'll have to check app support on Linage or PostMarketOS in the near future.
Seriously? Open computing is dead to you because you can't order fast food or play games? I don't even have Google Play on this GOS device. And, by the way, my banking app works fine on LineageOS. Not that I need it, since I use a hardware TAN generator.
But if I'm already using LineageOS without GApps, this wouldn't make any difference, right?
Edit: Also - thanks for all your work!
And soon you will need a second device with locked down bootloader and play integrity to use mainstream apps.
What when meta will require attestation to run WhatsApp? Not if, when...
I agree that those things are going to happen, but again, I'm deliberately not using GApps and thus no Playstore apps, including WA. Using an undesirable product is a vote for the continued existence of that product, so the only winning move is not to play, isn't it? 🤷
Would you recommend a B-2 Spirit solution or not yet?
I assume this is the same with GrapheneOS?
My bank app works without issue inside a private space with sandboxed Play services on my main user profile.
I also have an investment app which runs without any issue whatsoever.
Maybe I'm lucky and these Canadian companies just aren't dicks about mandating google.
As far as I'm aware, as of now, graphene does not meet googles attestation (Uncertified Device), because google says so, but is easily more secure.
Google's lockdown has zero to do with security.
I remember when internet banking meant installing some shitty "security" software on Windows before it would let you access the proper page on your browser.