this post was submitted on 05 Nov 2024
141 points (99.3% liked)

Android

17838 readers
87 users here now

The new home of /r/Android on Lemmy and the Fediverse!

Android news, reviews, tips, and discussions about rooting, tutorials, and apps.

πŸ”—Universal Link: [email protected]

πŸ’‘Content Philosophy:

Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it's in violation of the rules.

Support, technical, or app related questions belong in: [email protected]

For fresh communities, lemmy apps, and instance updates: [email protected]

πŸ’¬Matrix Chat

πŸ’¬Telegram channels / chats

πŸ“°Our communities below

Rules

  1. Stay on topic: All posts should be related to the Android OS or ecosystem.

  2. No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to [email protected].

  3. Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to [email protected].

  4. No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.

  5. No reposts or rehosted content: Share only the original source of an article, unless it's not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.

  6. No editorializing titles: You can add the author or website's name if helpful, but keep article titles unchanged.

  7. No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.

  8. No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.

  9. No offensive or low-effort content: Don't post offensive or unhelpful content. Keep it civil and friendly!

  10. No affiliate links: Posting affiliate links is not allowed.

Quick Links

Our Communities

Lemmy App List

Chat and More

founded 2 years ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
141
HSBC UK banning KDE Connect from F-Droid, and non whitelisted keyboards (lemmy.ml)
submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]
41 comments fedilink hide all child comments
 

(Rant)

At somepoint, HSBC decided KDE Connect installed via F-Droid is less secure.

Photo of the HSBC UK app urging I install KDE Connect via GPlay or Galaxy Store

Then it decide non-whitelisted keyborads are a security risk. Only Gboard and Samsung Keyboard is confirmed within the whitelist.

Photo of the HSBC UK app telling me to switch input method citing security risk

I understand the point that risk can be introduce at various points, yet this is simply too much. Yeah there are people phone infected by malware but from Play Store. Not a single time I heard one ever happened on F-Droid distributed apps, at least not from the official repo. Also, I will put more trust on an open source keyboard than any proprietary keyboard.

Furthermore, I'm shocked that an app can read my app list, and current keyboard (introduced in Android 14). This just make building a profile much easier as I belive everyone almost have an unique set of apps they like. I don't think any apps need such functionality. Why the f it needs to care what input devices I uses? This make me worry more about untold (aka burried deep in Privacy Policy) data collection.

top 41 comments
sorted by: hot top controversial new old
[–] [email protected] 57 points 1 month ago (5 children)

We seriously need a way to sandbox apps, where they cant see shit outside their sandbox

[–] [email protected] 7 points 1 month ago

Afaik that's how the corporate apps stuff works, I byod (I really should have a second phone) and the work stuff is totally on its own, uses a different keyboard, opens a different browser uses a different authenticator etc.

[–] [email protected] 3 points 1 month ago

If only we had that

[–] [email protected] 2 points 1 month ago

Isn't that the purpose of the work profile?

[–] [email protected] 1 points 1 month ago

Also a way to spoof the input.

[–] [email protected] 47 points 1 month ago (1 children)

Time to change banks

[–] merde 24 points 1 month ago (1 children)

money laundering is alright but how dare they impose gboard to their clients

[–] [email protected] 2 points 1 week ago

Unironically this

[–] [email protected] 46 points 1 month ago (1 children)

And then i complained that my bank blocked access if adb was enabled...

If there's no loan attached to that account, for me this message reads "sorry, we don't want you as a customer. Please contact a bank teller to have a full refund, uninstall this app and don't forget to leave a 1 star review"

I'm not willing to compromise on this shit. My phone is my phone.

[–] [email protected] 19 points 1 month ago (1 children)

Imagine one of my medical apps refusing to run because of adb..

[–] [email protected] 5 points 1 month ago* (last edited 1 month ago) (1 children)

My medical app doesn't let me take a screenshot of the bill statement when I wanted to contest an upcharge.

luckily there was still an option to download a pdf, but still there was no option at all to disable that BS.

[–] [email protected] 2 points 1 month ago* (last edited 1 month ago)

That's wack as hell.

In my case, Medtronic does a lot to prevent inspection of how their apks work at all, encrypting and obfuscating the code to make open-source emulation extremely difficult.

Luckily, hackers don't quit.

[–] [email protected] 30 points 1 month ago (1 children)

Sounds like it's time to use the website and not the app. And if you can't use the website instead of an app, you should probably switch banks.

[–] [email protected] 13 points 1 month ago (1 children)

I don't know a single bank that hasn't reinvented the wheel and is using their app as a glorified authentication app for generating totp codes

[–] [email protected] 4 points 1 month ago

Mine actually. I'm in the United States, but I actually switched banks. And the vast majority of the reason I did so was because my bank did not allow me to use the website to use their functionality. And so I said fuck you and left them.

[–] [email protected] 19 points 1 month ago

You need to formally complain to your bank, OP.

[–] [email protected] 16 points 1 month ago

I thought this was for employees of the bank on the work phone.

If my bank does this, they can kiss goodbye my $254.21.

[–] [email protected] 16 points 1 month ago

They are now blocking you because you are not using gboard and sam keyboard. Now it's too much . I stopped using mobile banking became they need g play services.

[–] [email protected] 10 points 1 month ago

That's annoying! I'm using Graphene and I just installed KDE Connect from F-Droid to test, which didn't trigger, however it did bounce me for using Heliboard. Changing to default keyboard and reloading worked, ie it can only see my currently active one.

Using Shelter to set up a second profile, or the new Private Space feature on 15 may help provide isolation.

Halifax/ Bank of Scotland/ Lloyds does an integrity check that rejects Graphene or LineageOS phones completely.

[–] [email protected] 9 points 1 month ago* (last edited 1 month ago) (1 children)

Check out Shelter by PeterCxy [FDroid - Source]
It uses Android's native work-profile feature to create a separate space for the apps you choose, so you could install the HSBC app there and it wouldn't be able to see anything outside its little bubble.
The downside is that AFAIK you cannot have multiple work profiles on the same phone, so if you have a MDM solution from work already installed like Intune you won't be able to use this, and given how draconian this app is, it might refuse to run if it detects its inside one. Worth a shot though.

This is the type of shit that has me losing faith in Android.
They added a fuck ton of restrictions on Clipboard Access because 'Privacy,' yet this clear privacy violation (with 0 use cases!!!) is still here.

You'd think that they'd create a permission you can toggle at will since they care about protecting you so much right?
Nope. Google's the one who decides who gets to use this capability and your wishes as a user can go to hell.

[–] [email protected] 4 points 1 month ago

Unfortunately, the work profile is already used up.

[–] [email protected] 5 points 1 month ago

Graphene and starling, works great

[–] [email protected] 5 points 1 month ago (1 children)

With recent releases CorePatch can spoof app source, but it won't help with keyboard whitelist.

[–] [email protected] 1 points 1 month ago

There is also Hide My Applist xposed module for rooted phones.