HSBC UK banning KDE Connect from F-Droid, and non whitelisted keyboards
HSBC UK banning KDE Connect from F-Droid, and non whitelisted keyboards
(Rant)
At somepoint, HSBC decided KDE Connect installed via F-Droid is less secure.
Then it decide non-whitelisted keyborads are a security risk. Only Gboard and Samsung Keyboard is confirmed within the whitelist.
I understand the point that risk can be introduce at various points, yet this is simply too much. Yeah there are people phone infected by malware but from Play Store. Not a single time I heard one ever happened on F-Droid distributed apps, at least not from the official repo. Also, I will put more trust on an open source keyboard than any proprietary keyboard.
Furthermore, I'm shocked that an app can read my app list, and current keyboard (introduced in Android 14). This just make building a profile much easier as I belive everyone almost have an unique set of apps they like. I don't think any apps need such functionality. Why the f it needs to care what input devices I uses? This make me worry more about untold (aka burried deep in Privacy Policy) data collection.
We seriously need a way to sandbox apps, where they cant see shit outside their sandbox
Afaik that's how the corporate apps stuff works, I byod (I really should have a second phone) and the work stuff is totally on its own, uses a different keyboard, opens a different browser uses a different authenticator etc.
Isn't that the purpose of the work profile?
If only we had that
Also a way to spoof the input.
And then i complained that my bank blocked access if adb was enabled...
If there's no loan attached to that account, for me this message reads "sorry, we don't want you as a customer. Please contact a bank teller to have a full refund, uninstall this app and don't forget to leave a 1 star review"
I'm not willing to compromise on this shit. My phone is my phone.
Time to change banks
money laundering is alright but how dare they impose gboard to their clients
Unironically this
Sounds like it's time to use the website and not the app. And if you can't use the website instead of an app, you should probably switch banks.
I don't know a single bank that hasn't reinvented the wheel and is using their app as a glorified authentication app for generating totp codes
Mine actually. I'm in the United States, but I actually switched banks. And the vast majority of the reason I did so was because my bank did not allow me to use the website to use their functionality. And so I said fuck you and left them.
how the fuck do they see that you have these apps?? Wasn't it google's justification for destroying /proc and all resource monitor apps with it that they have put querying of installed apps behind a permission?
So /proc is virtual so it is only processes and not apps.
The app probably requires a permission that grants it access to that information.
all apps have their own processes, and the names of the processes were often the package name
You need to formally complain to your bank, OP.
I thought this was for employees of the bank on the work phone.
If my bank does this, they can kiss goodbye my $254.21.
They are now blocking you because you are not using gboard and sam keyboard. Now it's too much . I stopped using mobile banking became they need g play services.
That's annoying! I'm using Graphene and I just installed KDE Connect from F-Droid to test, which didn't trigger, however it did bounce me for using Heliboard. Changing to default keyboard and reloading worked, ie it can only see my currently active one.
Using Shelter to set up a second profile, or the new Private Space feature on 15 may help provide isolation.
Halifax/ Bank of Scotland/ Lloyds does an integrity check that rejects Graphene or LineageOS phones completely.
Check out Shelter by PeterCxy [FDroid - Source]
It uses Android's native work-profile feature to create a separate space for the apps you choose, so you could install the HSBC app there and it wouldn't be able to see anything outside its little bubble.
The downside is that AFAIK you cannot have multiple work profiles on the same phone, so if you have a MDM solution from work already installed like Intune you won't be able to use this, and given how draconian this app is, it might refuse to run if it detects its inside one. Worth a shot though.This is the type of shit that has me losing faith in Android.
They added a fuck ton of restrictions on Clipboard Access because 'Privacy,' yet this clear privacy violation (with 0 use cases!!!) is still here.You'd think that they'd create a permission you can toggle at will since they care about protecting you so much right?
Nope. Google's the one who decides who gets to use this capability and your wishes as a user can go to hell.Unfortunately, the work profile is already used up.
With recent releases CorePatch can spoof app source, but it won't help with keyboard whitelist.
There is also Hide My Applist xposed module for rooted phones.
Graphene and starling, works great
You do know screenshots exist
Also don't do mobile banking
You do know screenshots exist
App doesn't allow screenshots or screen sharing as part of the security features
Also, don't do mobile banking
Many times that's simply impossible depending on the bank, and it's wholly inconvenient for most people. Security wise, it also depends on way too many variables, so you can't just tell people to not do it and don't elaborate further.
They there is little room to complain about the app. If you willing make yourself dependent on an app you might be out of luck.
Actually, I wouldn't be surprised if screenshots are disabled in that app considering the rest, to "stop leaking sensitive information".
Also don't do mobile banking
As opposed to what?
Anything else
When it allow screenshotting
If the app is so paranoid that it refuses to work after detecting a different keyboard, I should be surprised if it allowed screenshots.