Other European banks do it, too - N26 also rejects GrapheneOS.

I have an refurbished iphone sleeping most of the time in my desk drawer, used only for banking apps.

It also make me feel safer not to have always on me the key to all my accounts.

Dont take the fact that Wero still works for Bunq as an indicator that ASN or any other bank are doing something especially untowards.

Given Bunq's abysmal security track record it probably means they just forgot to enforce some policy that Wero requires on mobile devices - no matter how annoying these "no grapheneOS" policies are in general, of course.

SafetyNet was a mistake in general. But banks specifically are among the most obnoxious shitters when it comes to "you aren't allowed to do things except the way we want it".

Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.

By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.

ASN has been dysfunctional for years. They needed a bailout and ever since have only deteriorated in their operations. To be fair, their risk management has surely improved and their new CEO is great. But their actual operations are superbad. They only do the easy loans and mortgages because anything else they can't do. Still I think as a bank they are doing well, everyone is opening accounts there. Marketing matters more than service I suppose.

My bank app works on GrapheneOS but checks play integrity and disables biometrics and lowers limits.

Thankfully I'm not forced to use it since I can log into the bank and authorize transactions with the government digital signature app, which uses hardware attestation and considers GOS fully secure.

Funnily enough, the bank's app crashes on launch with memory tagging enabled which means they have memory bugs.

Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).

If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.

My (Dutch) bank Rabobank also blocks GrapheneOS [0], I contacted them about it, you get the usual thing, that "security is very important to them". Arguing is completely pointless, they don't understand what they are talking about. The Rabobank app works fine on Android phones that haven't seen updates in years...

However, via Aurora store it works fine... I do feel a bit uncomfortable about it, but it's a one-to-one connection to the Play Store, so should be fine... What I don't understand is how that can work, the app itself does no checking after it is installed I guess?

My other bank, bunq, keeps whining about some service but functions normally nevertheless (I should give Play services access to my "Phone", I don't understand what that entails so I refuse it). N26 and Trade Republic just work.

I don't get wireless payments via Google Pay, but I don't even want that. So I'm really looking forward to Walt [1]. I would even start my sub now if that'd help him get it available in a year... At the moment there is Curve Pay [2], they have their own NFC stack. Bunq also used to have that (back when they were very pro-privacy) but they ditched it in favor of that horrible Google Pay.

[0] https://discuss.grapheneos.org/d/24630-rabobank-app-no-longe...

[1] https://walt.is/

[2] https://www.curve.com/

However, ASN is the only Dutch bank that allows you to open and operate an account without owning and iOS or Android-based smartphone.

All other banks only allow you to open an account via their app.

I think we really need an open hardware signing authority for open-source roms like GrapheneOS.

The response from EPI/Wero in that thread is troubling:

https://github.com/PrivSec-dev/banking-apps-compat-report/is...

I really hope this doesn't mean other Dutch banks will follow suit. It's already quite impossible to actually contact someone at the bank who can understand the issue if it's on the technical side. I have no idea how I would even start to broach this topic with ABN Amro.

The title sets a lot of blame on the bank, but there might be other factors at play. It is possible that either national or european regulations or laws makes it mandatory for the banks to comply with a set of security features that makes it impossible for them to offer services to degoogled phones. There might not be any alternative because it would cost too much money to develop and more importantly to distribute it. It can also be the case that Google uses its influence over the android open source project to make sure it will never be the case.

I have a Pixel 6 with eOS and am happy that my banking app works on here. If it were to suddenly stop working, I would be kind of screwed though.

Similar thing happened with my Health Insurance. Germany is pushing towards getting rid of health insurance cards in favor of a digital identity. To manage this, use the NFC functionality at the doctor, and log into the insurance app or website for fetching messages, documents or other information, you will in the future have to authenticate yourself using a new authenticator app. Now the problem is, that the app from my insurer does not work! Surely because of some "non-standard Android" b****. Contacting their support is obviously useless, as they have no tech knowledge and assume that I have even less, therefore just regurgitate the same "how to install the app" steps from the Q&A. All I have left is to switch to a different insurance, who's ID app works on my phone.

While this is all very annoying, I do see the point that especially banking and insurance has to be very secure. And they aim to achieve this by obfuscation. Against this one might argue that open code is more secure, as everyone can check it. But this goes both ways, for good and bad intentions. And are there not much more resources and energy behind the bad than the good intentions?