Using banking app

Alwaff5

So I have been used Grapheme OS a year ago, and the only thing to finish my transition is to install the Bank App because all the people around me is dependent in those transactions.

For security, I made a profile to use the app, but in order to access, I MUST enter a code given by the SMS, no other way that I can do to procede.

Probably for the app itself, but I'd appreciate if someone tells me if this is a thing for all banking apps, my case is called "Banco Estado" from Chile, at least I know it's compatible with Graphene OS.

So, it's secure to install it on the main profile? Do I have to use the web? Or just can do nothing? That latter is actually not a possibility for me because like I said, we are all dependent in the constant transaction. 🫠

I'm reading all responses. 👀

Drinded

Murcielago Alwaff5

I understand the issue. Most likely, the app needs permission to read SMS, which should trigger the pop-up window asking for authorization to automatically fill in the code. For this to work, you also need to have Google Play Services installed.

In these cases, although it's not the most secure approach, I would recommend granting all the permissions the app requests during setup. Once the process is complete, you can revoke any permissions that aren't strictly necessary. If none of this works, you can try enabling the Exploit Protection Compatibility Mode.

Eirikr70

Hello, I don't understand why you want a dedicated profile for that specific app. Unless you have a strong threat model, I would recommend just to install it in your main profile.

KitsuneNoBaka

What is the problem? You can receive phones/SMS in other profiles. Just allow phone connections.

PS: some banks allow OTA authentications (google authenticator/aegis)

Murcielago

As KitsuneNoBaka and Drinded already stated, receive SMS in other profiles can be activated (Settings> System> Users> Name of Banking Profile> Turn on phone calls & SMS).

Looking at the GrapheneOS banking app compatibility list though, there is a comment regarding Chile's Banco Estado (which apparently is used by OP):

"During the authentication process, the app sends me an SMS with a code to verify. This code must be inserted automatically, since it cannot be entered manually. I don't know what else can't be done."

Source: https://github.com/PrivSec-dev/banking-apps-compat-report/issues/609

It seems to work giving Google Play SMS permission but i couldn't find information about if this also works across different profiles.

Drinded

Banks typically require a phone number when setting up an account or configuring security, as it's used to verify logins and as a 2FA method for confirming payments or transactions. In GrapheneOS, additional profiles can receive SMS and calls if properly configured in the settings, so that shouldn't be an issue.

If your threat model involves not wanting to share your personal number, you could get an extra number without mobile data to keep costs low and use it solely for banking. However, if your goal is to avoid providing any number and your bank requires one, it's likely you won't be able to access their services.

Alwaff5

Drinded Drinded Thanks, just if it's necessary, Could I use this in my main profile? Giving the initial permissions and then revoke any non strictly neccesarry?

It doesn't need Google Play services compatibility, only to corroborate through the SMS.