top 81 comments

sorted by: hot top controversial new old
[–] 92 points 1 year ago (4 children)

Fucking google at it again. Straight up turning into apple.

  • source
  • hideshow 4 child comments
  • [–] 44 points 1 year ago*

    You can blame the courts for this one. They basically ruled "Apple isn't a monopoly, because they don't even LET other people compete in the first place". (which is about a bass-ackwards as it gets but whatever)

    Google saw this and went "shit..." so they're rushing to implement the same thing.

  • source
  • parent
  • [–] -3 points 1 year ago (1 child)

    You would wish Google would turn into Apple. AAPL at least has the decency of respecting some privacy.

    Google, on the other hand, is an advertising company (not a tech company), selling all the people pocket size advertisement billboards named “Android” for years, and they’re taking the last step of seizing full control over it.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 39 points 1 year ago (1 child)

    Why the Google identity check is completely useless:

    Step 1: scammer acquires stolen id card

    What's the difference between malware developed anonymously and malware developed anonymously but registered under a fake id? It can be installed today and it can be installed tomorrow. Do they really believe that malware developers will doxx themselves when publishing their malware?

  • source
  • hideshow 1 child comment
  • [–] 38 points 1 year ago

    Fdroid is just the best. Around half of the apps on my phone are from Fdroid and Izzy.

  • source
  • [–] 120 points 1 year ago (44 children)

    Disclaimer: I have been a maintainer for LineageOS and a long time user.

    Whoever advocates for LineageOS don't get it. Using LineageOS will not fix any issue like this.

    Already today using LineageOS means give up on banking apps, ID apps, and even McDonald's and some games like Pokemon.

    Yeah because Google with play intergrity now demands valid keys that gets invalidated as soon Google detect they are used for such usage. The cat and mouse game suddenly got much harder to beat.

    So no, using LineageOS will soon be possible only with secondary devices and not your primary that you will need for your actual stuff to work.

  • source
  • hideshow 44 child comments
  • [–] 8 points 1 year ago

    I (for the moment) use stock android without a google account without any issues.
    Then again i don't use banking apps on a smartphone.
    My gov provides ID apps and they work fine - then again, GPS is installed of course.
    Fuck McDonnalds.

    I'll have to check app support on Linage or PostMarketOS in the near future.

  • source
  • parent
  • [–] 12 points 1 year ago (1 child)

    I've never had an issue with the three banking apps I tried on LineageOS, and I didn't even know there was a McDonald's app or pokemon games.

    If this list for /e/os roughly applies to LineageOS (with microG), I wouldn't call it "only for secondary devices", more "won't work for some people"

    Did I miss something? AFAIK google is requiring devs to ID, not to use SafetyNet or whatever the "only-runs-on-certified-phones" thing is called

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago*

    Same, my bank also doesn't require strict play integrity. I think I ran into an issue with a dating app once, but that's about it, and that's no real loss.

    If my bank would suddenly stop working on Android with microG (with no simple alternative), I'd just switch to another bank, there are enough.

  • source
  • parent
  • [–] 31 points 1 year ago (30 children)

    Counterpoint: I use the McDonald's app where it belongs - on a giant greasy ordering kiosk.

    But seriously, banks have websites. Everyone and everything has a website.

    I don't need Android apps at the cost of my privacy or at the cost of control of my devices.

    I use GrapheneOS as my only phone, and I have done so for years.

    Whatever the topic, I don't need an app for that.

  • source
  • parent
  • hideshow 30 child comments
  • [–] 55 points 1 year ago (19 children)

    I don’t know about the US but on this side of the pond banks have their own 2nd factor apps. So to log in to a bank’s website you need an app - quite probably with play integrity.

  • source
  • parent
  • hideshow 19 child comments
  • [–] 15 points 1 year ago* (3 children)

    That's insane, I have never heard of such a thing, but I'm in the US where most banks don't even have non-sms second factor.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 10 points 1 year ago* (last edited 1 year ago) (2 children)

    That's crazy. Yeah in the rest of the world you can't do shit on a bank website, it's mostly just view only, and the rest is via the app. If it lets you do anything at all, it'll require 2FA via the app.

    You can transfer money from a savings account with one bank to another account with another bank just via tapping said bank account icon in the app, like you don't even need the BIC/IBAN/AccNo/Name or any details, it knows where to go just because you have the app of the other bank, all you do is tap the icon.

    I'm not even sure you can withdraw the money from the savings account without having the app of the target bank installed on the phone, signed into the target account.

    Same way you can add a card to Google Pay by just tapping a button in the bank app, no details or anything required.

    Frankly I don't even know where any one of my bank cards are, I remember for a good while I had a credit card that I didn't actually have physically because when you open the credit card account (which requires extra checks compared to what is default - debit cards) they don't bother to ship the physical thing to you unless you explicitly ask for it (via an option in the app), since most people just use it only via Google Pay because everywhere is cashless and uses only NFC.

    I didn't realize at first but it meant that my "card" didn't even have a PIN, because there was no way to physically have it, any large transactions are authorized in the app, everything else, including IRL is implicitly authorized by me unlocking my phone with my fingerprint, which is required to make NFC payments on Android. I think with Apple phones it's required to open the app but for me since 2018 it's been muscle memory to tap the fingerprint reader and slap the phone on the NFC reader on anything from the tube to the dodgy corner shop.

    To get the actual card details it's a relatively hidden submenu in the app, to add to Google pay is a giant button on the card icon in the app.

    Convenient as hell but the sheer amount of privacy violations involved and info that must be gathered about the phone to do this in a compliant fashion makes me shudder.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 1 year ago (1 child)

    Not so convenient when one loses their phone or service. Then get locked put of everything.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago

    Yeah, happened to me. I tried to go to one of the bank locations but they not so subtly told me to fuck off and call their customer service instead if for some reason I couldn't use the 'in-app help menu'. The entire concept of me losing access to it seemed alien to them, as it I was born into the app or some shit, idk how much they pay those ghouls to stand there and gaslight folks like that but I sure hope it's a lot.

    To restore it I had to call them and turned out I needed to know some kind of extra hidden secret "telephone banking" password after fighting past 10 people who could barely speak English. I didn't know it ofc and like an hour later I was able to prove who I was.

  • source
  • parent
  • [–] 5 points 1 year ago (1 child)

    I've been using a dedicated TAN generator for banking since I first made my account but I don't doubt that's going away at some point, since debit cards from the same bank already require an app for 3-D secure.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago (5 children)

    No, hardware TAN generator work fine. If the bank wants to force me to use proprietary snake oil it's time for a new bank. Or using a dedicated old smartphone just for the app.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 1 year ago (4 children)

    Good luck, there are no other alternatives.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    Consors bank so far is an alternative. NFC cards, hardware TAN generators, app not forcing use of proprietary OSses. LineageOS is fine, need to check GOS.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 1 year ago (2 children)

    That's apparently a German bank. Interesting though, hopefully we get something like that elsewhere.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 0 points 1 year ago (4 children)

    Dang. Y'all need to pick better credit unions. MFA rolling token is an open standard. Any single app can support all of my (correctly implemented) tokens. I prefer Aegis, but they (correctly implemented MFA apps) all work.

    I don't want to trust my money to someone who can't implement standards compliant MFA.

    That would scare the daylights out of me.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 year ago (3 children)

    Well, they have a kind of 2FA since at least 30 years, long before rolling tokens were all over the place. Their latest implementations are as simple to use as Steam 2FA. If a bank isn’t able to implement a proper 2FA login there’s a ton of other security issues to worry about. Lastly, I think by using their own implementation/app they prevent their customers from using compromised apps.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago* (2 children)

    If a bank isn’t able to implement a proper 2FA login there’s a ton of other security issues to worry about.

    Exactly. Any organization whose MFA doesn't work on Aegis, I take action to protect myself from their incompetence.

    Lastly, I think by using their own implementation/app they prevent their customers from using compromised apps.

    I'm sure they claim that. But I still recognize it as simple incompetence. They aren't able or willing to hire someone with the Cybersecurity expertise to implement a relatively simple open specification.

    Y'all are welcome to risk your money there. It's probably insured anyway, right?

    For me, that's too much risk. Even if insurance makes me whole, getting robbed is a huge pain.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    Exactly. Any organization whose MFA doesn’t work on Aegis, I take action to protect myself from their incompetence.

    That'll surely end their business. /s

    I’m sure they claim that. But I still recognize it as simple incompetence. They aren’t able or willing to hire someone with the Cybersecurity expertise to implement a relatively simple open specification.

    Just out of curiosity: What percentage of the population is capable of running Graphene/Aegis? What percentage, regardless of capability, is willing to do so?

    Creators of popular OSS regularly warn about downloading their stuff elsewhere or pay for it. How do you think that would apply to any 2FA application?

    Now think of how stupid the average person is, and realize half of them are stupider than that. (love some George Carlin). Given that even (very) stupid people have and need bank accounts: How would you implement an authentication that can't easily be compromised to ripp off stupid people?*

    * Let's just assume that you, the lead developer, are not at all "incompetent", quite the opposite. Also take into consideration that you need to keep cost down (hint: That means you want no one to call support because of 3rd party applications!).

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    This is actually a solved problem:

    The credit union mplements (purchases from a competent vendor) their own custom branded standards compliant MFA solution.

    This is what competent organizations already do.

    Because the app is standards compliant, experts use Aegis instead of the branded app. Everyone else sticks with the branded app.

    Also because the app is standards compliant, provided by a specialized vendor, and occasionally being used in unusual ways by expert users, serious security mistakes are much less likely to happen, and less likely to only be noticed by attackers.

    I don't expect my credit union to tell me to use Aegis - I expect them to use a credible MFA vendor that interoperates correctly when I do use Aegis.

  • source
  • parent
  • [–] 16 points 1 year ago (9 children)

    Counter-counterpoint:

    Banks use their app to generate the otp and they reinvented the wheel so if you want to login you need to install it, can't use a generic authenticator. I am not aware of any single bank in the EU that allows the use of generic authenticators.

    For McDonald's, using the app gives at least 50% off. A menu in the app costs 5 euro while on the store kiosk costs 12 euro. I do not personally care because I find their food to be just barely edible, but I understand why there's a need to install the app

  • source
  • parent
  • hideshow 9 child comments
  • [–] 2 points 1 year ago (8 children)

    Some people have no smartphone at all. How can they be customers at your bank?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 3 points 1 year ago* (3 children)

    My bank had a device that was basically a simple android phone running the 2fa app. The phone app got updated through new versions and eventually got the drm treatment, but the old app keeps working because it is still running on those dedicated 2fa "devices".
    Naturally the bank is now trying their best to make people deregister the old "devices" and switch to only the "app".

    The old app has no internet permissions. It reads qr from the camera and shows verification as a 6 digit code.
    The new app has internet permissions and is integrated with other apps so you can conveniently accept the request of your banking app in the 2fa app (on the same phone) with a single tap via an overlay. 2fa.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 1 year ago (1 child)

    Exactly, trying to find software alternative for what ultimately going to be locked down hardware is never going to be a sustainable solution.

    Alternative OS means nothing if there's no widely supported open hardware with unlocked bootloader to run such OS long term, and Google is got all mainstream phone manufactures cornered legally and commercially with this and their requirement for manufecturer authorization for shipping GMS suite with their products.

    The only way out is this ridiculous decision of Google getting push backs from legislation, because there's nothing manufecturers can do and without them there's nothing FOSS developers can do to push back long term, and Google isn't stopping themselves from doing Evil™.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago (1 child)

    I assume this is the same with GrapheneOS?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    My bank app works without issue inside a private space with sandboxed Play services on my main user profile.

    I also have an investment app which runs without any issue whatsoever.

    Maybe I'm lucky and these Canadian companies just aren't dicks about mandating google.

    As far as I'm aware, as of now, graphene does not meet googles attestation (Uncertified Device), because google says so, but is easily more secure.

    Google's lockdown has zero to do with security.

  • source
  • parent
  • [–] 1 point 1 year ago* (2 children)

    Already today using LineageOS means give up on banking apps, ID apps, and even McDonald’s and some games like Pokemon.

    Yeah because Google with play intergrity now demands valid keys that gets invalidated as soon Google detect they are used for such usage. The cat and mouse game suddenly got much harder to beat.

    But if I'm already using LineageOS without GApps, this wouldn't make any difference, right?

    Edit: Also - thanks for all your work!

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 year ago (1 child)

    And soon you will need a second device with locked down bootloader and play integrity to use mainstream apps.

    What when meta will require attestation to run WhatsApp? Not if, when...

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago*

    I agree that those things are going to happen, but again, I'm deliberately not using GApps and thus no Playstore apps, including WA. Using an undesirable product is a vote for the continued existence of that product, so the only winning move is not to play, isn't it? 🤷

  • source
  • parent
  • [–] -2 points 1 year ago

    Seriously? Open computing is dead to you because you can't order fast food or play games? I don't even have Google Play on this GOS device. And, by the way, my banking app works fine on LineageOS. Not that I need it, since I use a hardware TAN generator.

  • source
  • parent
  • [–] 18 points 1 year ago

    DOWN WITH GOOGLE

    DOWN WITH GOOGLE

    DOWN WITH GOOGLE

    ...

  • source
  • [–] 33 points 1 year ago (21 children)

    When Android stops working properly, I'll move back to a dumb/feature phone. My wife will hate it, but so be it.

  • source
  • hideshow 21 child comments
  • [–] 11 points 1 year ago (16 children)

    Some friends and I were talking about the feasibility of that earlier today.

    It's possible, assuming that you never need to use your phone as an MFA method, never need to scan a QR code, or never need to use an app for something because they lack a web version.

  • source
  • parent
  • hideshow 16 child comments
  • [–] 9 points 1 year ago (11 children)

    If my employer wants me to use MFA, they can provide me the device.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 12 points 1 year ago (2 children)

    This is exactly what a Yubikey is for. They're phishing-resistant too, as opposed to TOTP codes.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (7 children)

    How about for any personal accounts?

  • source
  • parent
  • hideshow 7 child comments
  • [–] -1 points 1 year ago (6 children)

    My personal accounts do not use MFA of any kind and very few are tied to external accounts for any form of verification.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 1 year ago (5 children)

    Lucky you can get away with that. My bank requires the app, without it you can't even make transactions via the web UI because the 2FA is via their app. You can't even order a new card or many times order a physical card via their web UI because they don't bother sending you a physical thing anymore, intention being is that you add the card to Google pay for NFC and online payments and use it that way only. Everything is via the app. I actually have no idea what happens if I lose my phone, because as far as it has been made to appear my bank account is on my phone, there are no sign in details or anything of the sort, it's either there or it isn't.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 2 points 1 year ago (4 children)

    If my bank ever changes to do that, I would immediately find a different bank. Then again, whenever it's possible, I do business in cash.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    Yeah good luck with that, most places have been cashless since the pandemic, and there are no banks that don't do this, they're required to have 2FA by regulatory compliance and they all implement it as apps to offset compliance costs with data harvesting.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    I've not had that experience. Most of the places I go to or do business with prefer cash (most even charge for cards now), and my bank doesn't do that stuff. If they do, I'll just go to an FCU instead of a bank, since most of them do most of their business in-person.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago (1 child)

    That's because we live in different countries. Judging by you saying FCU, presumably meaning Fan Control Unit or United States Federal Credit Union, you live in the United States.

    I do not live in the United States. In the rest of the world, and especially Western Europe and the UK - where I live - cashless is very common if not the default.

    Again, outside of the United States (1 country), banks tend to work like how I described, so there isn't a bank that "doesn't do that stuff", and not only are most business cashless, there are even fairly common card payment machines at businesses that do not take chip and pin (or swipe, but they basically never did that, that's just an American thing), only contactless is an option.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 8 points 1 year ago* (1 child)

    never need to scan a QR code

    QR wishes it can someday become as relevant as you're giving it credit for. Haha.

    There is Aegis for MFA. It's much nicer than the closed proprietary ones.

    Of course, if a job requires something incompatible, then I'll let them buy me a dedicated device.

    Some services threaten me with "there's no web version", but they never end up being someome I want to do any business with, anyway. ¯(°_o)/¯

    But I do want a dumb flip phone again. They were cool.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago* (1 child)

    I hear you. My wife has also requested that I not deprecate certain proprietary apps until I can provide a good alternative that works on both Android and Apple. Last time was when we were traveling and wanted to share locations with each other in real time. I had to give WhatsApp location perms 🤮

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago (1 child)

    My wife will hate it, but so be it.

    Pretty sure you can build and self-host an SMS-whatever-she-is-using (e.g. Signal, DeltaChat, etc) bridge if somehow SMS isn't enough.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago* (last edited 1 year ago)

    Note to self if that were to happen : OSHW SIM modem (or even eSIM) that forwards to whatever (API, email, etc) that then bridges to other networks.

    I have a couple of PinePhone I could keep plugged in but otherwise any Android phone where one can load an .apk e.g. Termux could have a hook on SMS then forward accordingly.

    Edit: quick search, a 4G dongle costs ~20EUR today and for compatibility on e.g. a RPi https://forums.raspberrypi.com/viewtopic.php?t=210724 bother otherwise Ubuntu https://wiki.ubuntu.com/NetworkManager/Hardware/3G and example on Debian https://wiki.friendlyelec.com/wiki/index.php/How_to_use_4G_Module_on_Debian

    Edit2: didn't try it but https://alwaysconnected.eu/ proposes 1Gb for 1 year (probably already too much data... since one needs 0 if connected on RPi) for 14EUR and they sell a Huawei (not great but I imagine works well with the card) E3372 (no idea if it works well with Linux) for 60EUR.

  • source
  • parent
  • [–] 16 points 1 year ago

    The only apps I have installed from the play store are ones that came pre-installed with the phone. The rest are all from f-droid....

    LONG LIVE F-DROID ! !

  • source
  • [–] 15 points 1 year ago (3 children)

    really hope someone finds a way to break google's block on apks that aren't registered. with more and more manufacturers locking down bootloaders, changing roms is no longer an option.

  • source
  • hideshow 3 child comments
  • [–] 2 points 1 year ago (2 children)

    Except that it is still an option to only buy phones that allow bootloader unlocking and root? That's been a requirement for me since my first smartphone.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments
    view more: next ›
    131 comments in c/android@lemdro.id view that post
    13 comments in c/android@lemdro.id view that post
    7 comments in c/technology@lemmy.zip view that post