News for hackers. Stuff that matters.

A comment on Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS.

Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by microtonal on Friday November 06, 2026 @05:47AM (#50390722)
Some more details: various people contacted ASN, but they are mostly pointing to Wero. The Play Integrity check is performed in the method nl.devolksbank.mobile.banking.security.data.wero.IntegrityRepository#requestIntegrityToken. From the name, this seems to be ASN's own code and not an SDK from Wero. Someone also found that the integrity token gets sent to ASN's own servers: https://m.devolksbank.nl/bspc-payment-consent-administration... (De Volksbank is the owner of ASN).

If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.

[ Parent | on HN ]
Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by Muromec on Friday November 06, 2026 @06:16AM (#50390951)
Migration from ideal to wero was a change of a logo.
[ Parent | on HN ]
Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by jaapz on Friday November 06, 2026 @06:55AM (#50391287)
That's their "Phase 1". They are currently building new infra. My ASN bank app just yesterday actually wanted me to go through some reauthentication flow for migrating to Wero so maybe they are actually moving to that now.
[ Parent | on HN ]
Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by trashb on Friday November 06, 2026 @06:44AM (#50391187)
Wero is a standard that is implemented by each bank. The requirement can come from Wero, to be implemented technically by your bank.
[ Parent | on HN ]
Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by microtonal on Friday November 06, 2026 @06:49AM (#50391225)
I already addressed this in my comment:

If this comes from Wero as they claim, I guess we Europeans in countries that are covered by Wero are in for a bad time. That said, some Dutch banks also made the migration from iDEAL to Wero and don't require Play Integrity.

[ Parent | on HN ]
Re:Dutch 'idealist' bank ASN blocks non-Google Android, incl... by jaapz on Friday November 06, 2026 @06:53AM (#50391263)
Just the fact the method is namespaced under nl.devolksbank doesn't have to mean anything. Could just be vendored code.
[ Parent | on HN ]