Trying to figure out why banking app doesn't work

turmoil2750

hey, fellow Hungarian?

look at the update before the last one too. mine stopped working after that.

is it possible to add root certificates?

could an expert chime in here plz?

i was also thinking of simply flashing calyx os, what do you think?

i'm also in touch with granitbank customer service but they are completely useless. i think development is outsourced to an outside company: https://intuitech.studio/about

i was even thinking of calling them

it's a crazy situation ...... :(

other8026

turmoil2750 i was also thinking of simply flashing calyx os, what do you think?

This probably won't help. If you've already tried to troubleshoot the issue following akc3n's app compatibility guide, then there's something strange going on, and there's no reason to believe installing another OS other than the stock OS would fix it. GrapheneOS with sandboxed Google Play provides much better app compatibility than CalyxOS with microG.

Try checking if you see Settings > Apps > All apps > *app name* > Play Integrity API. If you have that entry, make sure "show usage notifications" is on, and "block usage attempts" is off. After doing that, launch the app again. Do you see a notification saying the app is checking Play Integrity?

gruser634

turmoil2750 Did some more investigation, I'm getting more confident that the NetLock CA removal is the problem. Monitoring the app's network traffic, it is connectiong to dc.api.granitbank.hu, which indeed uses a cert from NetLock.

I don't know how to proceed further as it is not possible to install additional root CAs into the system store, and apps won't use the user cert store by default anymore. So I guess they'll either have to change their certs, but I dont think that's likely until other Android distributions start removing this CA too or we'll indeed have to flash some other ROM (or an older version of GOS). Though it would be nice to actually confirm first this really is the problem, since I'm still not 100% sure on this, but all signs point there.

turmoil2750

other8026

thanks, i don't have the play integrity api thing. is that when you install something from play store? i did not install from play store so that maybe the problem

turmoil2750

gruser634

is it not possible to install certificates? i thought it was

other8026

gruser634 Monitoring the app's network traffic, it is connectiong to dc.api.granitbank.hu, which indeed uses a cert from NetLock.

If that's the case, you might consider asking them when they plan on changing that. Those certificates are being removed from Chrome, so more and more of their users will be affected in the near future. Those certificates are being removed because Google doesn't have confidence in those CAs

turmoil2750 thanks, i don't have the play integrity api thing. is that when you install something from play store? i did not install from play store so that maybe the problem

If you don't see the entry then it's not checking Play Integrity.

gruser634

turmoil2750 It is, but only into the "user" (not "system") cert store, which most apps won't use.

turmoil2750

gruser634

ok, at least we are getting somewhere. let's try to figure out this cert thing.

did you install from play store?

gruser634

turmoil2750 Yes, I installed from play store.
Another reason I don't think this is a safetynet or similar issue, is that the app's behavior is consistent with some connectivity issue, not integrity or root detection. When in the past I tried to use it in a rooted phone it did actually give me an error at the beginning. Now it just fails to load data.

turmoil2750

gruser634 ok that's good news. i'll explain this whole thing when i talk to customer service next time. they are supposed to call me sometime. although i doubt that they will understand a word of this

turmoil2750

gruser634 by the way, did you try with the CA cert installed as user cert? maybe it could work

gruser634

turmoil2750 I did, it didn't help.

turmoil2750

gruser634
:(

turmoil2750

gruser634
what's our strategy now? just wait for me to talk to customer service?

gruser634

turmoil2750 Unfortunately I'm out of ideas, so yes, unless someone has some other suggestion, I don't think there is much we can do. I also sent them a message trying to explain the situation but to be honest I have little hope they will do anything about it until other Android distributions start removing this CA, and considering that its still present in current AOSP I don't know when will that happen...

I will probably wait a bit but I can't really afford to not use this app for months, so I'm considering flashing the last working version of graphene eventually.

natoal

gruser634 Do you think it's worth buying a $100 second phone just to run these apps?

turmoil2750

gruser634

can we ask graphene os to put back the cert or are they usually non responsive?

turmoil2750

natoal

no, it defeats the purpose of having a private phone, because now you have a spy device which is recording everything you say around it

gruser634

natoal Banking is one of the use cases where I'd prefer and trust GOS way more than some random $100 trash

natoal

gruser634 how about 300 to 600 dollar phones which run near stock android like Nothing Phone

gruser634

natoal At that point I might as well just go back stock firmware... Spending $300-600 and carrying 2 phones because some cert file was deleted doesn't sound an appealing option to me. Not to mention that would also half-defeat the purpose of even having the private phone in the first place...