Trying to figure out why banking app doesn't work

turmoil2750

gruser634

is it not possible to install certificates? i thought it was

gruser634

turmoil2750 It is, but only into the "user" (not "system") cert store, which most apps won't use.

turmoil2750

gruser634

ok, at least we are getting somewhere. let's try to figure out this cert thing.

did you install from play store?

gruser634

turmoil2750 Yes, I installed from play store.
Another reason I don't think this is a safetynet or similar issue, is that the app's behavior is consistent with some connectivity issue, not integrity or root detection. When in the past I tried to use it in a rooted phone it did actually give me an error at the beginning. Now it just fails to load data.

other8026

gruser634 Monitoring the app's network traffic, it is connectiong to dc.api.granitbank.hu, which indeed uses a cert from NetLock.

If that's the case, you might consider asking them when they plan on changing that. Those certificates are being removed from Chrome, so more and more of their users will be affected in the near future. Those certificates are being removed because Google doesn't have confidence in those CAs

turmoil2750 thanks, i don't have the play integrity api thing. is that when you install something from play store? i did not install from play store so that maybe the problem

If you don't see the entry then it's not checking Play Integrity.

turmoil2750

gruser634 ok that's good news. i'll explain this whole thing when i talk to customer service next time. they are supposed to call me sometime. although i doubt that they will understand a word of this

turmoil2750

gruser634 by the way, did you try with the CA cert installed as user cert? maybe it could work

gruser634

turmoil2750 I did, it didn't help.

turmoil2750

gruser634
:(

turmoil2750

gruser634
what's our strategy now? just wait for me to talk to customer service?

gruser634

turmoil2750 Unfortunately I'm out of ideas, so yes, unless someone has some other suggestion, I don't think there is much we can do. I also sent them a message trying to explain the situation but to be honest I have little hope they will do anything about it until other Android distributions start removing this CA, and considering that its still present in current AOSP I don't know when will that happen...

I will probably wait a bit but I can't really afford to not use this app for months, so I'm considering flashing the last working version of graphene eventually.

natoal

gruser634 Do you think it's worth buying a $100 second phone just to run these apps?

turmoil2750

gruser634

can we ask graphene os to put back the cert or are they usually non responsive?

turmoil2750

natoal

no, it defeats the purpose of having a private phone, because now you have a spy device which is recording everything you say around it

gruser634

natoal Banking is one of the use cases where I'd prefer and trust GOS way more than some random $100 trash

natoal

gruser634 how about 300 to 600 dollar phones which run near stock android like Nothing Phone

gruser634

natoal At that point I might as well just go back stock firmware... Spending $300-600 and carrying 2 phones because some cert file was deleted doesn't sound an appealing option to me. Not to mention that would also half-defeat the purpose of even having the private phone in the first place...

natoal

gruser634 Yeah, I'm conflicted about this as well. I don't know if I'll switch back. Of course, it depends on why you're using the private phone in the first place (threat model). This is why I'm hoping that GOS will develop its own phone which would resolve the compatibility issues

turmoil2750

is there any chance graphene developers might respond to a request about this?

natoal

I believe the best way to make a request is by opening an issue in GitHub, but the recent changes have kept the developers very busy these past few days

turmoil2750

natoal

https://github.com/GrapheneOS/grapheneos.org/issues/1201