Around a dozen banking apps began specifically permitting GrapheneOS

Original Article ↗ Hacker News Discussion ↗

Several users report that most banking apps now work on GrapheneOS, with around a dozen banks having explicitly adjusted their checks to allow this hardened, non-Google-certified Android fork. Much of the debate centers on Google’s Play Integrity API, hardware attestation, and EU rules that push banks toward device- and app-integrity checks, which can lock out custom ROMs despite their strong security. Commenters weigh the trade-offs between genuine fraud prevention, checkbox-style compliance, user freedom to run alternative operating systems, and the growing pressure to access financial services only through tightly controlled mobile apps.

Banking-app support for GrapheneOS

  • Compatibility has improved substantially: ~90% of banking apps reportedly work on GrapheneOS, with ~10% blocked mainly due to Play Integrity checks requiring Google-certified stock OS.
  • Around 6–8 banking companies (≈a dozen apps) have explicitly changed code to permit GrapheneOS:
    • Some removed or fixed buggy anti-tampering checks.
    • Some relaxed Play Integrity usage.
    • Others added Android hardware key attestation as an alternative, whitelisting GrapheneOS (and potentially other OSes).
  • A community-maintained list tracks hundreds of banking apps and their compatibility levels (partial, full, main-profile-only, etc.).

Remote attestation, regulation, and Google lock‑in

  • Many banks rely on Google’s Play Integrity API for “device integrity,” which implicitly bans any non-Google‑certified OS, including GrapheneOS.
  • EU and other regulators increasingly require “device and app integrity checks” for banking/government apps; examples and guidance often align with Apple/Google attestation APIs.
  • GrapheneOS contributors say they push back on this trend, lobbying EU bodies and individual apps to:
    • Drop attestation entirely where possible, or
    • Use Android’s standard key attestation API instead of Play Integrity, so non‑Google OSes can be allowed via published boot key fingerprints.

Security model, root, and openness

  • Banks justify restrictions as fraud/malware mitigation; some commenters accept this, others call it “security theater,” noting many allowed devices are badly unpatched.
  • Debate over rooting:
    • Banking/MDM apps and GrapheneOS core devs see app-level root as fundamentally at odds with a strong sandbox model.
    • Others insist users must retain the practical ability to fork/modify, including adding root; remote attestation that rejects self‑built images is viewed as undermining user freedom, even if the code is open.
  • GrapheneOS emphasizes that unofficial builds are, by definition, a different OS; some banking apps whitelist only official signing keys, so self-built variants will fail attestation.

User experience: apps, web, profiles, NFC

  • Many prefer web banking and hardware tokens; others find apps more convenient. Some banks now limit key actions (transfers, card controls, PIN view) to apps only.
  • EU trends and bank policies are pushing away from SMS 2FA toward app-based approvals with integrity checks.
  • Multi-profile use: some banking apps refuse to run outside the main profile; reasons are unclear and seen as cargo-cult “security.”
  • Tap-to-pay:
    • Google Pay does not work on GrapheneOS; in Europe, some banks and services (Curve, PayPal, various local banks) implement their own NFC, sometimes requiring sandboxed Google Play.
    • A clean, Google-free open NFC wallet is desired but seen as hard due to card-network integration and bank buy-in.

Market structure, switching, and alternatives

  • Experiences differ by country:
    • In some places (e.g., UK), switching banks and auto-migrating direct debits is easy and used as leverage.
    • Elsewhere, banking is concentrated (3–4 major banks), often sharing the same restrictive app stack; switching doesn’t help much.
  • Some suggest using cross-border EU neobanks or non-bank services (e.g., Wise), though tax authority and employer restrictions on IBANs can limit this in practice.
  • There is anticipation of official GrapheneOS support on upcoming Motorola devices, but Google certification will still be unavailable, so Play Integrity–based bans will remain an issue.