I use GrapheneOS, but if you as a bank want to gate access to my money via some kind of technology, you better be including it as part of the account.

For example, HSBC continues to let me manage my bank account via the web browser, and continues to offer a battery powered hardware token as the means of authentication.

I let you hold my money, for whatever reason. Why do you expect me to be your distributed infrastructure provider? I am not going to let you require that I run your proprietary malware in order to access my own money.

The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.

I'd say that JS webapps are the same but at least there you run things on your terms in a sandbox that you can inspect and look at the requests, and there's no effective enclave carved out of your hardware (except for EME but that's another topic for another day and I'd be complaining if banks started to use it too).

None. Explicitly banned. And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.

Some. App works, but some functionality is unavailable. I've got a credit card app which works, but refuses to set up virtual cards or use "remember me". That's good enough for my use. Similarly, I had a merchant account which let me see my balance, but I couldn't use my phone as a credit card reader.

Works, but only in main profile. I'd rather keep financial things in a locked profile. But lots of banks disallow that.

Full. Everything works (although you may need to toggle some exploit protection off).

Some banks are reasonably good at letting you pass on technical queries to their developers - mostly the smaller ones. The nice thing about the UK banking sector is that it is trivial to move banks. So I switched accounts to providers which worked with my phone and let the old ones know why I was moving.

many have memory corruption bugs and incorrect anti-tampering code requiring our per-app exploit protection compatibility mode toggle

Ironic for apps that are often so paranoid about "security" and "hardware attestation"

I find all the people complaining about this to be rather insane. This is a completely open source linux distro getting official support from banks, some of the most legacy companies of all. This is good news. If companies are open-minded enough to support GrapheneOS, they're gonna be much more likely to also officially support other secure operating systems that are open source.

These are banking apps that weren't previously possible to be used on GrapheneOS. We're going from zero to one, not a step back.

[1] https://github.com/PrivSec-dev/banking-apps-compat-report/is...

Word is that banking apps that implement their own nfc interface within their app can be used for “tap to pay” on Graphene.

Curious as to how we can know which providers support this.

Thanks, but no thanks. Remote attestation is simply not acceptable. You use it, I won't use your app.

banking apps began specifically permitting GrapheneOS

In my view, that's not any better than specifically permitting Google only. This should not be a whitelist at all. I assume my self-signed GrapheneOS would fail this test?

https://privsec.dev/posts/android/banking-applications-compa...

Looks like good progress to me.

https://privsec.dev/posts/android/banking-applications-compa...

All of the ones relevant to me, just work fine.

I do not have any banking apps, and I log into a bank account maybe once in month or less often.

I wonder if it's intentional.

https://privsec.dev/posts/android/banking-applications-compa...

That crowd thinks 12 Factor applications are some monumental thing, "oh no, we can't do that, we would have to hire only the most expert experts, nobody does 12 Factor applications". They're all Windows tards.

Then as highlighted the other day, the big banks, including LLoyds, all run on Google's Cloud because ding ding ding big surprise they couldn't figure it out themselves, and they didn't deploy multi-AZ. They didn't do a rudimentary thing that virtually every startup knows to do and does.

The banks and the clowns that surround them are, by today's standards, barely computer literate.

all these reports assume user installed google play store and google services.

this is like installing linux, then wine, then all the windows bloatware back.

I'm just starting a deep-dive on it.

As a newbie, can existing users point out any other gotchas?

* EDIT: Oh ffs, only on Pixel phones ...