NationWide (UK Banking App) recognises GrapheneOS :)

anon67234

Ah i think GHub has shadow banned me or whatever (just created a throwaway account to upload the screenshot in the comment but can't see the comment once logged out). Anyway, I'll come back later and try upload image here directly if that's possible or check out imgur or something.

matchboxbananasynergy

anon67234 You can link to them. Uploading directly won't work.

Murcielago

That's good news, thanks for the update.

Did you also go into details like Play Integrity? If you like, you could share your (anonymized) letter here - then other users can use it as a template and also contact their bank.

anon67234

Right so GHub considers accounts made via one of the burner email providers as suspicious and doesn't let you do much for the first few day.

Anyway, I uploaded the screenshots to another image hosting site and it's showing up in browser/tabs without cookies so hopefully shows up here too (and if it does feel free to add it to the GH thread or else I'll try doing it after a few days if GH lift their shadowban):

pic-0 : https://ibb.co/Tq0W7YMX

pic-1 : https://ibb.co/jkcrPYL3

anon67234

Ah I can't edit my original post here it seems, the shadowban on GH is lifted now and I can see the current new post after logging out too: https://github.com/PrivSec-dev/banking-apps-compat-report/issues/332#issuecomment-2718936045

Hopefully that new link ^^^ works for everyone here.

NetRunner88

anon67234

Yes it works
and their answer is great !

MotherShipton

One of the comments on the privsec page reports that the app works fine without play services installed. Is there anywhere that I can get the app other than google play store?

DeletedUser370

MotherShipton One of the comments on the privsec page reports that the app works fine without play services installed. Is there anywhere that I can get the app other than google play store?

If the developers of the app publish it in other app stores, or provide an APK download, yes. If not, it's possible to use other apps or websites that attempt to fetch the APKs from Play Store, but using the Play Store is the official recommendation by the GrapheneOS project. I attempted to summarise that here: https://discuss.grapheneos.org/d/20760-im-confused-about-google-accounts/30

anon67234

MotherShipton I got it from Aurora Store - that doesn't require play services etc (in-fact that profile of mine is pretty de-googled - no play, no compatibility layer and so on). My usual pref is Obtanium > Aurora Store > Play store. Anything via Play store is in its own separate profile where play and compatibility etc are installed/activated.

I don't know how recommended this approach is though.

MotherShipton

Thanks. Actually I de-Aurora'd my devices a couple of weeks back with a factory reset and reinstallation of my (relatively) few apps using only Accrescent and Github/Obtanium. This was after reading advice such as that linked above.

For now, I will stick to banking using my Vanadium browser. It's not the worst hassle to have to sign in each time and I'm confident it is safe and secure.

anon67234

MotherShipton Yes ofc, browser banking will totally work and is more private (for instance Nationwide app upon first install clearly says it's going to send home the details about all the installed apps on the system for "security" reasons).

However, my effort in petitioning the banks is because of the following reasons:

With some banks it's almost impossible to do banking without their apps. Eg. app-only banks like Starling. Their features are too modern for many of us to overlook (spaces, virtual cards, limits per card etc).
Logging in via browser is a PITA. Most banks that I've used don't just use username + password which would be easy to fill via password managers - hardly takes time. They will have nonsense like key in xth, yth and zth characters of memorable word, followed by a pin which they'll send you via an SMS (instead of using things like TOTP) and what not. This makes frequent logging in very painful (esp if your memorable word is also actually randomly generated), specially if you give out different cards to different services and want to freeze/unfreeze them regularly etc.

The 1st question that folks have asked me when I told them to install GOS is "do the banking apps work" and "does google pay/nfc pay work" etc. So that is obviously a very high priority for many, even if they are willing to sacrifice other bits (like fancy AI integrated camera etc).

I think if we have Banks recognise GOS as a platform they support, that by itself will lead to a more accelerated adoption (for eg. in my own family). Maybe it'll one day lead to most/all banking apps also support NFC payment in addition to googe/apple pay. Maybe more crowdfunding for GOS too. That's how i see it.

Viewpoint0232

anon67234

To add to that, without an app you usually won't be able to get notifications for transactions.

waynea

Nationwide works fine on my Pixel 7. I actually moved to Nationwide after over 40 years with Lloyds Bank because of their hostile attitude to GOS. I raised a formal complaint about it and got told to bog off. So i told them to bog off and moved to Nationwide

custardbomb

waynea works perfectly on my p6p too

Infernal_pizza

Do NFC payments work? I'd consider switching bank if they do

monozygote

Infernal_pizza NFC payments totally work with Curve at the moment (in the UK at-least, but assuming Nationwide is UK only, it's probably what you meant anyway).

Curve is independent of the bank you choose. I think it registers itself as a subscription service with the bank (at-least in the debit-details the bank tells me it's likely some kind of a subscription service). So it itself doesn't suffer the limits of the contactless (physical) cards that banks might put. For instance I recently paid £300 at a store and it went through. I could never pay more than £100 via contactless physical card in the same store every and had to use chip-and-pin which makes me a bit uncomfortable, being surrounded by cctvs/customers/seller-agents etc.

Caveats:

Curve needs play services, doesn't work for me without it.
Doesn't work in private space where I could just unlock and pay and lock it again. So unfortunately it needs to be in a parent-profile which is a PITA to lock because you can't kill the profile and open it back again with biometrics - so takes enormous time to switch profiles + type in password while others are waiting in queue.

I don't know why (2) happens and if it's a limitation of Curve app or NFC payments from private space in general or something to do with GOS specifically.

edent

monozygote how do you set up Curve for NFC?

I have the app installed and have added my cards to it. But I don't see an option in the app to use it for tap-to-pay.

In Android's Contactless Payments setting, I just see "None" or "Goole Play Services".

Thanks for any help 😃

oci3o

edent Quite easy.

Download Curve (Play store ideally, I have tried it via Aurora also).
Create an account or sign-in.
Add a default card (Debit or Credit).
It will then ask you if you want to enable Curve Pay, select Yes.
It will do some quick checks, then say Set Curve Pay as default, it then takes you into settings, you should have None, Google Play & Curve, Select Curve.
Go back to the app, thats it.

My first transaction I got a weird error about multiple cards, but I suspect it was the fuel terminal, tried it on a vending machine at work and it worked perfectly.

edent

oci3o ah! I'd already set up my cads last year. There's a new setting in Curve's account to Switch on NFC. Once that was done, I added it as a payment method. Looking forward to trying it out 😄
Thank you!

oci3o

anon67234 Monzo does the same.
You can bypass it however, its just a warning saying it maybe rooted, might do the same as you and mention it to their support, did you say anything in particular to their support?

I've had some issues with the monzo app in terms of accessing specific features (most of the app works), maybe linked to the integrity failure, but its nowt major for me.

anon67234

oci3o did you say anything in particular to their support

Are you referring to this in my post:

Next on my radar is Bank Of Scotland whose app says it's a rooted or a jailbroken device (ie. doesn't support GrapheneOS at all).

If so, BoS gave me the middle finger unfortunately. There gave me a call & did that politely though. Not just BoS but mostly anything from Lloyds banking group doesn't seem to work as they are the same financial institution I think. Anyway they said that some of their own devs use GOS and aren't able to install their apps and do it via Browser. Due to a very low number of customers demanding GOS support for their app, they are currently unable to "invest" into making changes to their software. However they would keep an eye on the request and if enough folks start asking, they might invest into this.

As for what I had told them earlier, it was a just a standard complaint form and telling them a bit about GOS, linking the attestation guides etc same as what I did with NationWide in the screenshots but more elaborately since unlike NationWide they don't support GOS (or any custom ROM I think) at all at the moment. I even told them they are looking bad because they are probably the only ones in the UK that completely don't support GOS. Others either just work without Play services (Starling/NationWide etc) or need Play services, but BoS are just being d**ks atm.

I guess they are too big to care but if more folks start shaming them they might come around.