• GeneralSolved
  • [admin: misinformation about SafetyNet Attestation API deprecation]

andrewteg Do you or anyone else know if those EU has any plans to allow people without a smart phone to bank, and if GrapheneOS users could get into that group if so?

I mean, it's not a legal requirement to use Android/iOS. There's no law saying banking apps can't run on Windows or GNU/Linux, I guess. And you still have the option of a physical TAN generator, just that this is something not all banks offer and often you have to pay for. If you bank with any of the new mobile-first banks like Starling, Revolut, Monzo or N26, I don't think there's a way to use them without smartphone.

    You are considering a worst-case scenario : your bank app is still compatible with GrapheneOS. So let's wait and see. When many banking apps are no longer compatible, then time comes to consider other options.

    Elk9877 The problem is that the PSD2 requires

    two or more of the following elements: (i) knowledge (something only the user knows, e.g. a password or a PIN); (ii) possession (something only the user possesses, e.g. the card or an authentication code generating device) and (iii) inherence (something the user is, e.g. the use of a fingerprint or voice recognition). These elements are independent (the breach of one element does not compromise the reliability of the others) and designed in such a way as to protect the confidentiality of the authentication data.

    The phone is very convenient as a proof of possession.

    Fortunately in Germany all banking apps work fine. I would never ever even think abiut giving up GrapheneOS because of wrong behaviour of developers..In the EU at least integrity checks might get obsolote anyway.

      gustl In the EU at least integrity checks might get obsolote anyway.

      What makes you so confident ? Are you sure that your banking apps don't use SafetyNet ?

      Because EU will shut down step by step anti competitive behaviour..especially from the gate keepers...just watch what what will happen to Apple if they do not really comply...app store rules will show next..fines of up to 10% of global turnover will even hurt the big guys...

      In worst case i will use the browser and hardware for tans..never i will give up GrapheneOS becausevof a few unnecessary apps and stupid so called convenience...the people should rewire their hardwired brainwashed brains..sorry only my opinion..do not want to offend anyone...

      They should, but how's it going convincing others to think that way? I've been pleasantly surprised by how easy it is to get by without Google, and I'm thankful to Lineage, /e/, and Graphene for showing me I can. Doesn't change the fact that if I'm the only one in my friend circle using Signal, its futile. Doesn't change the fact that banks will not make massive changes to their app for the minority.
      I agree with you that FOSS is better but you do get to a point that your phone is a brick when you make no compromises.

      I think you can not convince people..especially not fircing anything on them..if someone is ready to wake up and change it will happen..we all know ourselves, that real changd in life in many situations happens sudden due to a certain level of pain or enlightment...

        gustl I agree with you on the principles of the EU fighting the californian monopolistic behaviours. Anyway I have been quite disappointed noticing that such a major public french digital ID app as L'Identité numérique de La Poste relies on Play integrity checks.
        On the other hand, the french taxes, who also relied on Play integrity, switched to another GrapheneOS compatible protocol, which I am grateful for !

          andrewteg Do you or anyone else know if those EU has any plans to allow people without a smart phone to bank, and if GrapheneOS users could get into that group if so?

          EU Germany:
          I've never used banking apps. Online banking is possible via website and QR TAN generator.
          I have Master and Visa card. Never opted in for PSD2. I can pay worldwide with both.
          I do my daily purchases with cash. This is the most anonymous.

          Is Play integrity verification only not possible on a so called "degoogled device" or also on a device with GrapheneOS + Sandboxed Google Play installed?

          Eirikr70 I don't use "L'identité numérique" from "La Poste" but I'm not very surprised that this kind of app behaves this way, for several days I've had an error message on BoursoBank warning me that my trusted device cannot be verified and that the app will soon stop working... I'm thinking of sending them the attestation compatibility guide, you never know, otherwise I'll go through Vanadium.

            Xtreix I'm thinking of sending them the attestation compatibility guide

            I have done so with the french taxes app, and it now works fine with GrapheneOS. I don't know if my message has played a role in their decision to switch to the Attestation API but the result has been favorable. I have just sent the attestation compatibility guide to the Dinum (France Connect) in order that they ask La Poste to change API.
            Boursorama being a private actor, might be less willing to switch. Anyway if you decide to write to them, let me know, I'll do the same.

              Eirikr70 that such a major public french digital ID app as L'Identité numérique de La Poste relies on Play integrity checks.

              German Ausweisapp luckily it's FLOSS.
              Because of “Public Money, Public Code” campaigns among others from Digitalcourage, FSFE and CCC.

                Xtreix Anyway, I draw your attention to the fact that the Boursorama app works. In order to connect, I have to authenticate, then it throws me an error message, I quit, kill the app and authenticate again, and it runs just fine.

                  Eirikr70

                  Eirikr70 I have done so with the french taxes app, and it now works fine with GrapheneOS

                  Thx for the info!

                  Eirikr70 Anyway, I draw your attention to the fact that the Boursorama app works. In order to connect, I have to authenticate, then it throws me an error message, I quit, kill the app and authenticate again, and it runs just fine.

                  Yep I know, but we don't know for how long yet, I'll let you know if they accept.

                  GrapheneOS changed the title to [admin: misinformation about SafetyNet Attestation API deprecation] .