Not sure what you mean. This should be the default for most things. Giving corps levers to abuse the users/consumers is going to result in exactly that.
As Dunning said and Marx quoted:
> "With adequate profit, capital is very bold. A certain 10 per cent. will ensure its employment anywhere; 20 per cent. certain will produce eagerness; 50 per cent., positive audacity; 100 per cent. will make it ready to trample on all human laws; 300 per cent., and there is not a crime at which it will scruple, nor a risk it will not run, even to the chance of its owner being hanged."
AFAICT, psd2 should be sufficient to do the most elemental of banking features. See transactions and initiate them.
But that is quite limited.
To provide me with API access to my own accounts, Era goes through another third party provider which again connects to my bank. I guess they could eventually get direct connections themselves.
So instead of me get convenient read-only access to my bank, I've ended up giving two separate third party providers credentials I'd prefer they didn't have.
All I'd need was an automated way to get a CSV or JSON dump of my transactions and I'd have been happy, but none of my banks support that without manually logging in. It's infuriating.
it would be if wasn't for the obvious reasons of those being banks
I also consider restrictions against open source to be malicious acts - hence also malware, such as by banks and other companies. Or, worse, government agencies. In a local medical university in central Europe, for instance, we are required to either have a Google account or a Microsoft account - usually the latter, to access emails.
All paid by the taxpayers ...
Do you really think banks care about you installing custom themes or whatever? They only care because the cracked Spotify app also has malware bundled on the side which uses the new root access to break the app sandboxes.
The Fire Phone was a midrange Android phone from 2014 preloaded with Amazon's app store and services instead of Google's. It failed on its own merits, but I think Google got scared someone else would do a better job. The barrier to entry is a lot higher if most people can't use their banking app on it.
I keep seeing people say this, and it keeps being true that you can just go to your bank's website and do whatever it is you want to do.
Maybe not for you, but you don't know his bank. Obviously I can't pay with my phone if I sit at my computer and use online banking in browser, so obviously payment with phone app won't work if I use browser on phone, for all other online banking functionality there is no benefit in the app, all of my 3 banks I regularly use don't require any card reader or even smartphone, all I need is any phone being able to receive SMS with 2FA codes, if my bank required app to use online banking I would just stop using their services. I am not going to bother with app in the phone while sitting at computer with 32" display and proper keyboard.
Not all banks. Monzo doesn't have banking through the website, and I doubt they're the only ones.
Most European banks either don't have a web banking at all, or require a mobile app to log into it. There are exceptions but they are rare and becoming even rarer.
There are app only banks, you make your choice and you pay your price.
> will this mean we have to support one more standard, one more release channel, one more modified OS?
Android apps don't have to take any active steps to support third-party distributions. All they have to do is refrain from taking active stops to block them, but I suspect you knew that.
[0] https://www.nytimes.com/2003/06/30/business/technology-a-saf...
Since this post is about a Dutch bank, I think it's important to add some nuance to this. In the Netherlands, banks have pretty much been made responsible for any money a client loses that a bank could have theoretically prevented. This includes people wiring their life savings to someone who pretended to be a bank employee or police officer. This has become a massive cost to banks over here and they're trying to do anything to prevent this.
Right now, I need to wait 4 hours before I can increase the maximum amount I can transfer through internet banking. Want to buy something expensive and you forgot to do this? Too bad, try again in 4 hours.
> forces banks to provide access through a common API standard
Doesn't PSD2 already provide this?
It was nice to be able to spend $30k+ on short notice. With modern security features, there is no need to enforce an arbitrary time limit if the depositor accepts the risks.
Eg the above example; how is it possible to send money without knowing who the other side is? I can trivially look up a domain name and see registration info, I can look up the IP to see who it’s registered to, I can check certs to see if they’re valid and legit.
It’s bizarre how normal we think it is to send large sums to random strings of digits that we think are Amazon or the IRS with basically 0 way to validate them.
I bought a house in cash and putting the money in escrow was unbelievably stressful. They send me numbers, on a printout that’s a scan of a scan of a scan with text that says “call to make sure this is still the right account number”, and a bajillion warnings to make sure the number is right or vague and terrible things might happen.
Insanity that I can get insanely complicated gadgets shipped to my house in 4 hours but we don’t have a better way to move 6 figure sums than “double check your numbers”.
"Open banking" is kind of a thing with PSD2/PSD3, but in name only. In reality, it's impossible to build anything useful. Interacting with any of the "open" APIs requires approval from a national bank (or similar institution), which means there are many hoops to jump through.
There is only one bank I know of that offers an API for end users ("bunq" IIRC). Every other god damned bank insists on being user hostile.
You mean the step from sandbox to production application, or you're not even getting access to the sandbox itself? I managed to get sandbox access with ease via two separate banks (both Spanish though), with no problems, think it took them one (working) day or something to review my "application". I never tried to get anything into the production environments though, but makes sense they'd be a bit tighter on that tbh.
Access to that kind of data requires regulation, a lot of it and that's why Third Party Providers exist. There are a lot of them in Europe and they're not expensive.
I actually didn't expect to find anything about bunq around here but I have to say they're the worst bank I've worked with. When we started working with them, their API were broken and the devs had no idea why. It seems to have improved recently but it's definitely not a bank to praise for their API.
And now we have a paypal-like shopping experience via SEPA Instant Payments, all our PayPal hating customers are happy ;)
I know, that's my point. It's a stupid decision.
> Access to that kind of data requires regulation
It's my data. I want to access it how I see fit.
> There are a lot of them in Europe and they're not expensive.
I already have a bank and I already pay them. I don't want to pay anyone else to be able to use my bank account in a way that suits me. Sadly, there aren't many good options.
Someone mentioned Wise, and they do seem pretty interesting. But it makes no sense why common high strees banks refuse to cater to power users, or even to users who aren't using mainstream devices.
They often act as marketing and can find and report security vulnerabilities rather than the criminal element doing so first.
It ain't your data, it's the bank's data about you. Banks are shitty about access, APIs because they are perpetually in CYA mode from KYC/AML rules from the US (also on most foreign banks) and GDPR and cousins in Europe.
I was actually surprised how many bank apps will work under GrapheneOS even if only partially.
Seriously, count your blessings man. In America we only get Plaid, which only works right or reliably for big banks (which are also the worst ones), and it isn’t an API for humans, just a paid SaaS product that a company who wants to offer integration with banks has to pay (i assume a lot) for.
Neither are technically a bank, but provide banking services. Mercury is more focused on big earners, and Crew is focused more on budgeting. Both have pretty extensive API surfaces.
(Disclaimer: Affiliate for Crew)
Vágj bele!!
Balances are held in Wise at your own risk.
Wise is really just a glorified interface on the account. And no, it's not a shared account. Those don't really exist in Japan.
Even if they did, I feel the result will be the opposite of what you expect. EU own reference implementation of eID relies upon Play Integrity [0].
[0]: https://github.com/eu-digital-identity-wallet/eudi-app-andro...
That would solve the issue rather quickly.
If they identify as a normie or an appliance peddler who is offended by the tone suggesting computers "should" be general purpose?
Or they are offended by the implication that said normies are perhaps unable to understand this lost potential, rather than making principled choices to embrace the appliance shlock?
So anyway, maybe the cheaper solution to your snow problem is to move here to Ireland :D
I fucking hate rublox for this. My children are not allowed to play this game for other reasons so the problem solved itself.
I like reusing old phones with custom ROMs.. it makes so much sense not to produce more waste.
I believe the fit is so poor that google should really object to it. I already refuse to make youtube videos because I need my gmail account.[1] If I need my google account for my ID and my payments I cant use gmail.[2] I also don't need Google ads badly enough.
It doesn't take a lot of stupid to lose the account but ANY account activity at all may trigger false positives.
In theory the US government can seize EU google accounts. Given time I'm sure we can find even crazier rulers than Ursula and Donald combined.
[1] - I got one flag for a 10 min video including 10 sec of 1991 footage from a local NZ news agency credited both in the video and linked in the description.
[2] - I've already lost my account once temporarily for jokingly hitting reply-all without looking how many cc's there were.
It's just a way for app makers to point their finger at someone else.
No, Play Integrity labels those old systems as secure, _even though they are not secure_ due to lacking years of security patches.
Play Integrity does not prove that something is _secure_, only that the OS that is running _was approved by the phone maker_.
This is the crux of your entire argument, so you kind of need to actually substantiate it. Does Play Integrity catch an app from to Play Store using an exploit against a comically ancient vendor kernel to do anything it wants? How?
An immutable OS install and app sandboxing by default provide a lot of security. Those are present on third-party Android distributions that don't pass SafetyNet. Some users of those add root access so they can let a handful of apps out of the sandbox, but I'm willing to bet most of those are tech experts with better security habits than the average person.
Show me examples of actual data breaches and account takeovers SafetyNet would have stopped if you really want to defend this position.
I use legacy banks for some stuff (typically things that require underwriting), and neo-banks EMI's for things where legacy banks just don't move fast enough (cross boarder transactions, shared accounts, automations).
you assume this exists / can exist
(for a given set of reasonable requirements which aren't yours)
but various "practices" and "regulations" for software security push banks into the direction of such nonsense, so if a major reasons this is happening is the government asking them to fix it is very reasonable
similar in other context where that argument is often used you have problems like monopolies, collusive agreements or various source pushing companies into acting collectively user hostile weather it's laws or other reasons
the government fixing such things by changing laws/regulations is pretty much the only things which can work in many cases
this doesn't mean they have to tell companies exactly what to do, instead they (should) find out what pushes things in bad directions and then "counter balance it" in some form or way
To bring it around - the Non-Google android user base is small enough right now that there is no motivation for them to spend money to make their verification/validation stuff work on any non-mainstream platforms.
You dont actually give them money...you loan them money when you do a deposit. That is why they pay you interest, and that comes with the risk of loans to another party.
A little detail they are happy to omit and they are happy to let people talk about: "I have money in the bank", that you of course ...dont have.
Not really related to the discussion here though, since we were determining whether the interest rate is zero.
There's no real risk involved.
More if you're in Silicon Valley… semi-/s
As of June 2026, the FDIC had approximately $161 billion in its insurance fund against...drum roll... $10.8 trillion in insured deposits.
Good luck calling on your insurance on a systemic bank crisis....
A situation which calls that borrowing capability into question would mean the economy is so bad the dollar is worthless.
I trust the FDIC to be far more johnny on the spot to resolve a liquidity issue than I do any private entity
It'll be a hardship if a bank does liquidate and the FDIC takes some time to reimburse everyone involved, but that's better than not getting anything at all.
The bank still uses the deposit money in that system. You are right to point out those same people on the street I mentioned would freak out even more if they knew that banks essentially lend out more than we deposited and also that they might sell your debt and all that jazz (I bet most people either never understood what happened in 2008 or forgot already other than a vague "yeah mortgage crisis")
Absolutely true. They question here is how many announce they are borrowing from you :-)
That's what banks do. It's not a secret. Any cursory understanding of banking gives you that information.
Why do people who don't know how banks work think they get paid interest on their savings?
Hint: Gold has no more to do with it than any other commodity does. Ditto with petroleum.
Unfortunately, banks can be held liable for customers getting scammed. Even if they win in the end, they have to make the customer whole first no matter what [1].
[1] https://www.tagesschau.de/wirtschaft/verbraucher/eugh-konto-...
Because courts have made them pay the curtomer their losses when the customer (not the bank) was scammed/hacked/etc.
- max length of passwords (not talking about lengths that would pose a DoS threat, talking limits like 20 characters)
- incredibly constrained character set for passwords (“your password can’t contain a quotation mark, only alphanumeric and these specific 10 punctuation marks”)
- “security” questions (can we just ban these already? Knowing that my childhood dog’s name was Bingo should NOT give you the ability to change my brokerage password.)
EU has PSD2 which enforce good, strong rules on customer authentication. For example, banks must have two-factor authentication. And if both factors live on the same phone, the bank has to safeguard against that phone being compromised. Hence the root detection and app-integrity checks that he is complaining about.
But what's tragic is that instead of understanding the problem, which is partly driven by regulation and partly not even a problem, is that he calls for more government regulation. What a mess.
It's a very difficult set of choices.
When you actually own your crypto currencies because you have the keys Binance cannot give away your money to North Koreans.
When you work in a regulated industry, you have to get pentests. The pentesters come with a list of "recommended best practices" to harden / secure your apps, which include all of the bullshit you mentioned.
It's a finding if they're not implemented. Even if the dev team doesn't want to implement these things they get forced to by policy and the overall process :/
You'd have to find someone quite senior to sign off on the risk and who would fight vigorously against the cyber/policy teams for basically no benefit to themselves. They would also have to be super pro freedom and highly technical to even understand the issues, which is not the personality profile of the kind of executive who ends up with overall authority over a bank's mobile app.
I basically said it was bullshit, pointed out that this was not industry best practice, and that we weren't storing any sensitive information.
The meeting ended quickly (and it became clear that the auditors were full of hot air.)
- auditors which commonly "pass" things which should be flagged, but happen to be a more expensive then normal industry standard in ways which should make them non-competive but somehow they get hired a lot
- auditors which flag nonsense and don't understand anything about security at all
some of the "security frameworks" which are applied by default makes a lot assumptions about how software is build/structured/works _based on what was common in the 90th_, and they don't even list their own assumptions... Luckily they are a base line you can perfectly fulfill but still a pain.
Like e.g. a session key having 128bit entropy is a reasonable minimum, but then imagine the framework assumes the session key & session id are the same because some 90th software did so and now requires you session ids to have 128bit entropy, but e.g. UUIDv4 has only 122bit entropy and a UUID being used is deeply integrated into middle-ware you use and can't be changed... (And having a session id=session key setup is anyway a bad idea as it means you mustn't log the session id anymore, but you also might have requirements which do require logging session ids in audit logs and similar).
This isn't even the most nonsensical thing I had ran into, just one I remember well. There where rules based on assumptions of you uploading files into a file system _using the upload file name_ while interleaving security sensitive web-server config files with uploaded directories ... like yes I know some software did so in the past but the rule should be "your software musn't do such a negligent thing" and not "you software must do this 5 extra steps in case it maybe does that insane negligent thing"
I noticed this, because entering password was very laggy and saw in developer console it was sending a request with every key stroke.
You need to have a bank account to live a life outside the woods.
I have multiple bank accounts, because I am a solopreneur, yet all of them are weird in their own ways
> Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
Ok, the question is then: exactly why do they go through that much trouble? Because that's a lot of trouble.
Did the higher ups want more effort to be spent on "security"? Yes. Is there any way to actually add "more security" to the setup? No. Could not doing anything in face of direct orders from the above be bad for your career? Yes. So random bullshit go.
It's not like the bank client developers are even implementing any of it themselves. They buy someone else's middleware and hopefully don't misconfigure it when they cram it into their builds.
Wow, where'd you find a bank with a mobile app that lean? Please share for everybody's benefit! /s
Half a gigabyte of app bundles is unfortunately no longer an outlier...
You mean like HTTPS? It's a shame that mobile banking website have fallen out of favor.
Over and over again you have to contend with bullshit like 120MB APKs full of obfuscated code, root detection, custom firmware detection, "non-mainstream device" detection, VPN detection, and even more obscure spyware-flavored functionality.
By now, if a major regulator like EU steps in, cracks the whip, and forces banks to provide access through a common API standard to any third party banking app? I'd welcome the change.