Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS
658 points
• 6 days ago
• Article
Link
围绕 PrivSec-dev 兼容性存储库中 ASN Bank 移动应用的讨论，凸显了银行安全实践与使用 GrapheneOS 等隐私优先的替代操作系统之间日益加剧的矛盾。最初，不少用户反馈体验参差不齐：有人无需 Google Play Services 也能使用该银行应用，而也有人在登录环节遇到了阻碍，主要出在连接检测和设备完整性校验等环节。
随着讨论历经数年发展，焦点逐渐从应用的基本可用性转向 iDEAL | Wero 支付系统的严格门槛。许多用户发现自己已无法继续使用这些支付服务，因为应用程序要求必须通过 Google Play Integrity API 的验证。对重视隐私、并坚持去谷歌化环境的用户而言，这无疑是一道高墙：该机制实际上会拦截不符合 Google 特定认证标准的设备。
参与讨论的人对银行依赖美国基础设施表达了明显不满，并认为这与 Wero 希望推动欧洲数字主权的目标相悖。由提交投诉的客户提供的 ASN Bank 官方回应也印证了该银行确实遵循由 Wero 倡议所设定的集体安全要求。银行表示，这些严格的完整性检查是为了符合有关防欺诈与支付安全的欧洲监管要求；同时，针对使用不受支持操作系统的用户，他们目前没有提供任何绕过方案。
这场讨论也折射出对金融行业依赖专有设备认证机制的更广泛质疑。批评者认为，依靠 Google Play Integrity 不仅是试图越过边界、阻断对关键公共基础设施的访问，还属于技术层面存在问题的做法：它忽视了更安全、开放的设备认证替代路径。受影响用户普遍认为这一现状难以长期维持，许多人呼吁对金融监管机构施加协调施压，确保银行服务对所有公民开放，不论其所使用的移动操作系统为何。
The discussion surrounding the ASN Bank mobile application on the PrivSec-dev compatibility repository highlights a growing tension between banking security practices and the use of alternative, privacy-focused operating systems like GrapheneOS. Initially, users reported mixed experiences, with some able to use the banking application without Google Play Services, while others encountered barriers during the login process, specifically relating to connectivity checks and device integrity verification.
As the conversation evolved over several years, the central issue shifted from general app functionality to the strict requirements of the iDEAL | Wero payment system. Many users found that they could no longer access these payment services because the application mandates Google Play Integrity API verification. This has created a significant hurdle for users who prioritize privacy and de-Googled environments, as the system effectively blocks devices that do not meet Google's specific certification criteria.
Participants in the discussion have expressed frustration with the bank's reliance on American infrastructure, arguing that this contradicts the stated goal of Wero, which is to foster European digital sovereignty. Official responses from ASN Bank, provided by customers who filed complaints, confirm that the bank follows the collective security requirements set by the Wero initiative. The bank maintains that these strict integrity checks are necessary to meet European regulations regarding fraud prevention and payment security, and they currently offer no workaround for users on unsupported operating systems.
The dialogue highlights a broader critique of the financial sector's reliance on proprietary attestation mechanisms. Critics argue that relying on Google Play Integrity is not only an overreach that prevents access to critical public infrastructure but also a technically flawed approach that ignores more secure, open alternatives for device attestation. There is a strong consensus among the affected users that this situation is unsustainable, with many calling for coordinated pressure on financial regulators to ensure that banking services remain accessible to all citizens, regardless of their chosen mobile operating system.
439 comments • Comments Link
- 越来越多的银行应用开始强制执行 Play Integrity 检查，以识别 Root 、定制或"非主流"固件，从而有效封锁像 GrapheneOS 这样注重隐私的操作系统。
- 金融机构辩称，这些限制为保障安全、降低风险并满足相关法规所必需，因为法规要求银行对客户欺诈以及未经授权的交易承担责任。
- 持怀疑态度的人认为，这些检查并不等同于真正的安全，并指出银行往往允许使用过时、未打补丁且不安全的 Stock Android 设备，却唯独针对小众、以隐私为核心的替代系统。
- 像 PSD2 和"Open Banking"倡议这样的监管框架在实践中提高了技术门槛，要求第三方提供商应对复杂、限制性强且带有专有色彩的 API 结构。
- 对 Google 专有设备认证基础设施的依赖导致权力高度集中，迫使欧洲银行把数字主权外包给美国科技公司。
- 随着金融机构推动用户进入往往缺乏与桌面端功能对等性的"仅限移动端"生态，传统基于浏览器的银行业务逐渐式微，从而加剧了客户的挫败感。
- 一些银行通过强制要求所有交易都必须进行基于移动端的身份验证，进一步限制用户的自主权，使得在缺少标准 iOS 或 Android 设备的情况下操作账户变得更困难。
- 绕过这些限制的做法（例如使用辅助设备或专用硬件）通常被视为权宜之计，而不是解决用户控制权持续丧失的可行方案。
- 有人主张只能通过立法干预来遏制反竞争行为，并呼吁出台强制性的、与平台无关的认证标准，或制定禁止封锁合法软件的法律。
- 整个行业之所以纷纷采用这些限制性措施，是出于对监管处罚的恐惧，导致机构更倾向于使用平台提供的"省事"安全工具来应付合规，而不是投入开发更强、更透明的身份验证方法。
上述讨论凸显了金融部门对可证明的风险管理需求，与高级用户对设备主权的强烈诉求之间的尖锐矛盾。尽管银行坚持认为设备认证是对抗复杂欺诈所必需的防御层，但不少技术用户认为，这些做法更像"安全剧场"：把便利性和责任转移置于真实安全之上。归根结底，银行业对美国"Big Tech"的身份验证依赖，实质上削弱了欧洲的数字自主权，让用户除了承受专有生态系统的约束，或在获取基本金融服务时遭遇巨大障碍外，几乎别无选择。 • Banking applications increasingly enforce Play Integrity checks to detect rooted, custom, or "non-mainstream" firmware, effectively blocking privacy-conscious operating systems like GrapheneOS.
• Financial institutions argue these restrictions are necessary for security, risk mitigation, and compliance with regulations that hold them liable for customer fraud and unauthorized transactions.
• Skeptics contend that these checks do not equate to genuine security, noting that banks often permit outdated, unpatched, and insecure stock Android devices while specifically targeting niche, privacy-focused alternatives.
• Regulatory frameworks like PSD2 and "Open Banking" initiatives have, in practice, led to increased technical gatekeeping, requiring third-party providers to navigate complex, restrictive, and proprietary API structures.
• The reliance on Google's proprietary infrastructure for device attestation creates a centralization of power, forcing European banks to outsource digital sovereignty to American technology companies.
• Customer-facing frustrations are compounded by the decline of traditional browser-based banking, as institutions push users toward mobile-only ecosystems that often lack feature parity with desktop versions.
• Some banks are further restricting user agency by mandating mobile-based authentication for all transactions, making it increasingly difficult to operate accounts without a standard iOS or Android device.
• Strategies to circumvent these restrictions, such as using secondary devices or specialized hardware, are often viewed as temporary workarounds rather than sustainable solutions to the loss of user control.
• Legislative intervention is suggested as the only viable path to curb anti-competitive practices, with some calling for mandatory, platform-agnostic attestation standards or laws that prohibit blocking legitimate software.
• The industry-wide adoption of these restrictive measures is driven by a fear of regulatory penalties, leading institutions to favor "easy" compliance through platform-provided security tools rather than developing more robust, transparent authentication methods.
The discussion reflects deep tension between the financial sector's need for demonstrable risk management and the desire of power users for device sovereignty. While banks maintain that device attestation is a necessary layer of defense against sophisticated fraud, many technical users view these measures as a form of "security theatre" that prioritizes convenience and liability shifting over actual security. Ultimately, the industry's reliance on American "Big Tech" for identity verification has effectively eroded digital autonomy in Europe, leaving users with few choices beyond conforming to proprietary ecosystems or facing significant friction in accessing essential financial services.