Nordea Mobile (danish) claims malicious software running

fid02

lbschenkel Thank you for sharing this. I can confirm that the app no longer complains about an accessibility service when TalkBack is disabled in the profile where the Nordea app is running. Although it's generally inadvisable to disable system apps, as it may cause confusing issues down the line, it seems to be the only solution to get this app working.

So it appears to not have been Play Integrity after all. Which I consider good news, even though the app is weird. I still think it's a mistake that it's detecting the presence of an accessibility service and blocking access to the app even when the accessibility service is not enabled. I'll be filing a bug report with them about this.

[deleted] Thank you for sharing with me the worry about the safety of my money with this bank. Although my money in the bank is protected by Norwegian regulations which will cover losses up to 2 million NOK (or whatever the sum is now) for losses in deposits caused by a bank's negligence*, I am considering to never actually take advantage of their services. I currently have a total of 0 NOK invested with them, so the imminent danger is not large.

I'd be happy to receive banking recommendations by DM, though.
I'll stop my off-topic ramblings in this thread now.

Note that I'm not speaking as an expert. Just a random person on the internet.
*Don't take legal advice from a random person. Look it up yourself if you are in need of this knowledge.

GrapheneOS

Please report this issue to the app. They certainly shouldn't do this when the accessibility service isn't even enabled, and they should always allow system apps since they're part of the OS.

MentalM

GrapheneOS
Hi, I have reported the issue at Nordea Denmark now a week ago, right after I had updated both the App, and received the latest GrapheneOS update. I have kept my Bank account manager up to date on whatever new I got from the support page. He is in direct contact about this with the dev team. I have not yet told the bank manager that disabling the TalkBack app will already ´fix' the app not working, as it does not fix the underlying problem. I assume that they will learn about that soon.

Sort of "Off topic"
The remaining app I have not yet dared to transfer to my new phone, pixel 8 pro, is MitID. Loosing access to that app, being not a native Dane, feels like Digital Suicide... :) (So if any of you has any tips :)

Last but not least:
Being new to GrapheneOS, I love the community and the Devs. TYVM for all.

fid02

MentalM There's a thread on MitID here: https://discuss.grapheneos.org/d/1520-status-of-mitid-app
Recommend scrolling to the very latest posts for tips. You can also ask questions there.

GrapheneOS

MentalM It will help if you let them know the issue is caused by their faulty check for accessibility services. It doesn't make any sense for that to ban having not activated accessibility services and it also doesn't make any sense for it to check for system apps since those are included with the OS which is inherently a trusted party.

MentalM

fid02
Thanks for the link !
I just ´woke up´ and had found that thread after writing my request. As the thread is describing the now more than 2 year long struggle, I am not yet done reading through the whole 230+ entries :)

lbschenkel

MentalM No need, just check the gist. TL;DR: MitID works. I use it daily.

MentalM

lbschenkel I will, after I have received my ´backup´: The Code-Display. I will have a bit more confidence in being able to use MitID, having that device present, if the app will fail.

MentalM

GrapheneOS Hi, I wanted to go and write to the bank, but I see now, it has been fixed, at least for GOS users. Thanks:
lbschenkel :)

GrapheneOS

We'll bring it up with the EU Commission next time we chat with them if they haven't resolved it by then as an example of anti-competitive behavior along with being a direct attack on users with disabilities since what they're essentially doing is forbidding operating systems from including open source TalkBack or other accessibility services which are not the Google builds.

Light

fid02 Can confirm this... I called them and they had no idea, I asked wtf they going through my phone. Smh... Might switch. O+ 8Pro.

lbschenkel

Update: by (ab)using personal connections I was able to reach the team in Nordea that develops this app and explained the situation. I don't know if the systemic issue of blacklisting system apps was addressed, but specifically in the case of Talkback they agreed it was a false positive and changed it. The rules are stored server-side so the app is already fixed. I checked with Talkback both on and off in the accessibility settings and the app no longer complains.

At least for GrapheneOS this will be enough to fix the problem.

I also confirmed with them that the app is blacklisting any accessibility app that is turned on and the installation source is not the Play Store. This is by design.

fid02

lbschenkel Can confirm that the app now works with TalkBack enabled.

Massive thanks for this! The insight about them disallowing accessibility services not installed from the Play Store is also useful, and interesting.

lbschenkel

fid02 The insight about them disallowing accessibility services not installed from the Play Store is also useful, and interesting.

Not that I agree with this, but Nordea app is not alone in doing this. As I wrote in a previous post, the BankID app from Sweden also does the same, although it shows a much more helpful message which includes the name of the accessibility app it didn't like. According to my experiments, BankID checks if the source is Play Store and disallows anything that is not.

de0u

lbschenkel According to my experiments, BankID checks if the source is Play Store and disallows anything that is not.

Just curious, since you appear to have an avenue for asking questions...

Isn't the EU requiring Apple to allow multiple app stores on iOS?
Are all accessibility-service apps in the Play store free of malware and exploitable bugs?
Have any accessibility-service apps on F-Droid been shown to harbor malware?

lbschenkel

de0u:

These all pertinent questions and I did talk about this briefly, including that it seems to go against the the new Digital Markets Act in EU, however I didn't press on the issue because I was talking to the developers, and not the decision makers who are imposing those requirements on the team. Many of those decisions are done above their pay grade. But they said that the config for this was deliberately put server-side, so if business requirements change then they can tweak the rules more or less instantly without requiring an app update.

To understand decisions like this, we have to understand the mindset of an organization such as a bank. They are not tech companies and don't want to get involved with any of this. IT is a cost. By simply "outsourcing" the vetting of apps to the Play Store, they can say they have done enough due diligence and at the same time block the vast majority of malware. If they allow other things, not only they have more work because they need now to vet apps and/or stores, they open themselves to more potential liability. That is how they think. The incentive is to minimize effort and/or liability to the bank. Any collateral damage is not a factor to them by default.

I'm not defending it, by the way, just saying how I see the incentives playing up to cause these outcomes.

de0u

lbschenkel The incentive is to minimize effort and/or liability to the bank. Any collateral damage is not a factor to them by default.

Of course. But mightn't they face liability (both legal and publicity) by nuking a legitimate accessibility service? Wouldn't a discrimination lawsuit by a disability-rights organization be painful?

By no means am I suggesting you sound like you are threatening to sue them! But if they think "just saying no" to things is safe, and they aren't seeing how that might blow up, maybe helping them think a bit more broadly might be mutually beneficial.

nixodus

Talkback can now be enabled from disabled system apps so it was fixed on Nordea server side indeed. Even though it even wasn't really in use in my question.

Bitwarden client cannot be enabled in accessibility menu :(

lbschenkel

nixodus Not true, I have Bitwarden enabled and the app does not complain — however, I installed Bitwarden from the Play Store. If you didn't, indeed it won't accept it because it only allows accessibility apps from the Store.

nixodus

lbschenkel indeed I don't have google play services installed in the profile which I've got Nordea app installed in and will not install them either so nordea app is from aurora store.

lbschenkel

de0u I did mention all of this for them to think about, including that they could be blocking critical apps needed by disabled people.

But it's a bit much expecting the organization to change course based on a 1-hour conversation with the developers who are not even the product owners. What I can say is that I did express these concerns to them, what happens next is up to them.

de0u

lbschenkel What I can say is that I did express these concerns to them, what happens next is up to them.

It's great that you were able to do that.

« Previous Page Next Page »