Neon Banking App Crashes on Login

tobru

I'm trying to use the Neon banking app on GrapheneOS, but it crashes on login. I've installed it via the Google Play Store - it has the App id com.neonbanking.app.

I also tried to see a crash in adb logcat, but couldn't see any meaningful message why the app crashes.

Any ideas?

MetropleX

When you say installed via the Google Play Store, is this in a profile with sandboxed Play Services in it or do you mean via Aurora Store in a profile without?

tobru

It's in a profile with sandboxed Play Services. The app is installed via the official Google Play Store, not Aurora Store.

pinsl

Works fine for me in work profile (installed with google play store)

MetropleX

tobru have you granted the app all the relevant permissions it asks for as listed in their FAQ https://www.neon-free.ch/en/faq/ and can you please contact the bank and ask them if they require SafetyNet ctsProfileMatch or have any dependencies on Play Services if you have:

https://www.neon-free.ch/en/faq/?faq-category=1&faq-entry=21

Once resolved can pinsl and yourself go and fill out a report for our community banking app resource by @akc3n here: https://github.com/akc3n/banking/issues/new?assignees=&labels=&template=app_report.yml

tobru

To be on the safe side that there is no stale corrupt data around, I deinstalled the app and did a fresh install from Google Play Store, but still the same behavior. After entering the pin code, the app just closes. Entering the wrong pin properly tells me that the pin is wrong, and the app stays open, so I can try again.

tobru

MetropleX have you granted the app all the relevant permissions it asks for as listed in their FAQ https://www.neon-free.ch/en/faq/

Yes, all permissions granted.

MetropleX nd can you please contact the bank and ask them if they require SafetyNet ctsProfileMatch or have any dependencies on Play Services if you have:

So I asked them, but as expected, they have no clue:

GrapheneOS wurde von uns nicht getestet, daher können wir nicht garantieren, dass es funktioniert. Dasselbe gilt für Android SafteyNet, wir haben keine Möglichkeit das zu testen.
Google Play Services werden für Notifications gebraucht, die App sollte aber auch ohne Google Play Services funktionieren.

Automatic translation to english:

GrapheneOS has not been tested by us, so we cannot guarantee that it works. The same goes for Android SafteyNet, we have no way to test that.
Google Play Services are needed for notifications, but the app should also work without Google Play Services.

In the meantime I've upgrade to Android 13, but it still just vanishes on login.

lberrymage

tobru Another thing to try is ensuring you have native code debugging enabled in Settings -> Security.

MetropleX

All I can suggest is grabbing a bug report and creating an issue on the tracker. May be the same issue that affects Lastpass. As suggested for that you could try disabling exec spawning. SETTINGS>SECURITY

If you can't grep through the report tag me here and I'll arrange for you to submit it to a dev.

tobru

lberrymage Another thing to try is ensuring you have native code debugging enabled in Settings -> Security.

That made the application start, and I was able to successfully sign-in. I reproduced it: Disabling native code debugging again makes the app closing again after login.

Neutron2920

For me it works with the phone permission

akc3n

Just wanted to update this with a couple additional points.

Banking apps project is now located at:
https://privsec.dev/banking

The issue form template has been updated today to include Pixel 7 series as well as our per-app exploit protection compatibility mode option.

I've created a post on some common solutions that may resolve some banking apps compatibility issues:
https://akc3n.page/banking-issues

Schoggi

Hello, I would like to know if Neon works now, I'm about to buy a Pixel for Graphene and Neon is on my top 10 apps that I really need on the phone.

Schoggi

Reply to my own question for the next ones.
Yes it works fine with Neon, at least if you have Sandboxed Google Play services (didn't try without).

martin-braun

@tobru They make use of the SafetyNet which would fallback to the captcha web work-flow, since GOS is not recognized by Google within the network. At least that is what I observed when implementing it by myself. Did they fallback to the captcha web work-flow, i.e. did a browser open shortly, when you verified your phone no. in their app?