Hacker News Reader

Comment by riedel | Hacker News Reader

Even with a Smartphone you will have a terrible experience if you do not use stock vendor software. On a custom rom one needs to install zygisk modules [0] to get around the play integrity madness (before that safetynet). As this still dies not rely in Hardware attestation it could works in emulators, too. What we need are court rouling against this ! Banks actually force us to give our data and sell souls to Google an Apple.

[0] https://github.com/chiteroman/PlayIntegrityFix/releases

Edit: seemingly PoCs exist : https://xdaforums.com/t/poc-safetynet-bypass-for-emulators.4...

View on HN

My phone is running LineageOS and my banking app works, so YMMV.

thank you so much, riedel. this is the first answer that addresses the question. i appreciate the effort you put into digging and sharing your knowledge.

Alternative mobile OSes may work for banking apps, it's hit or miss. For example, SailfishOS (perhaps the only viable Linux distribution on phones, a successor of Nokia N770-N9) comes with an Android emulation layer if you purchase the license. Many banking apps work fine there.

Frankly, I find the current situation really frustrating from a security perspective and also because it has created a duopoly that is impossible to escape. Some banks offer SMS as 2FA (insecure, very susceptible to SIM cloning). Others offer push notifications inside apps (iOS or Android with Google Play services) which is not really a second factor, and pushes you to either Apple or Google. I wish hardware keys were more widespread and/or ChipTAN was still an option.

Plain Waydroid might work depending on the exact application you're using. Try that first because it's pretty seamless and has good performance (as Android processes run directly on the OS).

I used it for three years before giving up and getting a used phone (for other reasons). My banking application detected all other emulators, but not Waydroid.

thank you! i will try.

> What we need are court rouling against this !

Not possible, since this is a requirement of EU regulation.

Reply on news.ycombinator.com