I used to run Shizuku for my phone to run Hail (an app suspension tool). Now that my credit card bank start checking for USB Debugging I stopped using the app (and now my 3DS OTP has to be over SMS). I believe there's only two banks left in Thailand that do not check for one and it is just a matter of time, because any time these banks could have hired any of those "security" people who will ask why don't we block that.

So I moved to Dhizuku. It's a bit hard to setup, but once I'm done it's felt like untethered jailbreak - I don't have to complicated dance to start Shizuku now. Dhizuku basically make your phone a company phone, except it report to you. To setup a "managed main profile" you'd need to remove all accounts visible in Android account system and type a long ADB command so I don't think it can be maliciously done.

I suppose this will be how we'll use F-Droid in the next year for enthusiasts.

▲

cuu508 2 days ago | parent | next [-]

Perhaps using the bank's website is an option?

I don't have a banking app installed on my phone. When I need to make a bank transfer I sit down at the computer.

▲

pmontra 2 days ago | parent | next [-]

Not the parent poster but my bank uses its own mobile app for 2FA. No app, no website.

▲

cuu508 2 days ago | parent [-]

Perhaps there's another bank you can switch to? Here we have a few mobile-only banks, but traditional banks with websites and physical MFA devices as an option too.

	▲	ninjin 2 days ago \| parent [-]
		Sadly, traditional banks are very eager to get rid of dedicated multi-factor devices in favour of their own mobile applications. I have seen strong encouragement via nagging and some going so far as to start charging for physical multi-factor authentication devices. Likely this gives them another way to milk information out of you, push their marketing onto to you, and saves them from having to manage physical devices. The obvious downside is of course a degradation in security and further cementing the duopoly and more or less forced participation in it that we as citizens have to endure.

▲

whs 2 days ago | parent | prev | next [-]

It's not an option on most Thai banks due to Bank of Thailand's regulations.

They requires that for any transaction past 50k THB per day (not per transaction) you'll need to provide face recognition. This means banks need to develop its internet banking solution past Web 1.0 era. From what I know (and I didn't do much research) most banks simply just shutdown internet banking instead of complying with that, only business banking get a separate website. My bank they simply merge the personal banking and corporate banking into a new system, but you still need to approve the transaction on a push notification (and perform face recognition).

It doesn't help that I believe many online casinos and scammers are scraping internet banking and even mobile banking APIs. There was a bank that apparently you could find PHP classes on GitHub that emulate their mobile app, and when that was in the news people were saying that the bank doesn't have proper security even though to use the class you'd need to provide exact same information in the app itself. Scammers used those code to move money from mules to mules, obfuscating the money's movement. The banks doesn't talk to each other either, so once the money goes through a few banks the chance you could trace it is almost none.

There was a court case that the court have ruled that if you were to get scammed to install apps on your phone that scam you for money, the bank is at fault as they have improper security. So they're heavily incentivize to protect users from themselves.

As for facial recognition, disabled people sent letters to Bank of Thailand, as legally blind people are not compatible with the liveness checks, the bank apps do block screen captures and refuse to work when any accessibility services is on and all BoT says about that is "we already told banks to do something" and the disabled people just send a second open letter this week, as many banks did nothing, some banks probably have a backend account flag to bypass the checks but didn't train the branch agents to perform such changes on the account.

Also Thailand has move into cashless - most local people don't use cash now except for small mom & pop shops that are doing dodging tax. Of course credit card is not accepted (or with minimum) - Thai business owners doesn't like fee no matter how small it is.

▲

cenamus 2 days ago | parent | prev | next [-]

Don't know if it's the same there, but where live (and I guess all of the EU) most banks allow you to use the website, but require the phone to authorize logins and transactions (as 2FA basically)

	▲	kalaksi 2 days ago \| parent [-]
		I live in EU and my bank also offers a separate MFA code generation device

▲

silverliver 2 days ago | parent | prev [-]

My bank retired their online banking website in favor of their app.

Not only that, but many of their core services (national payment network) are now exclusively offered in their app and no where else (yes, they will not allow you to do them in person or through their ATM). Your bank _will_ disable their website when you are the only one left using it.

I am not exaggerating. There is no way for me to use these core services if I don't use their app and they wont allow me to use their app thanks to their google play policy.

Unless otherwise mandated, their website will go away and they will have their way with your rights and make you pay for it.

Don't shrug this off. Fight this while you still can.

▲

sureglymop 2 days ago | parent | prev [-]

It's your device and you should be able to do what you want. I do want to point out though that in your specific case, your use of such tools, whether Shizuku or Dhizuku does actually affect the security of your device and could easily be exploitable. And yes, even lending the DeviceOwner permission to another app temporarily is not great...

However, it's problematic if the banking apps also block regular configurations on something like GrapheneOS, e.g. by inspecting the initial call stack of an app. There are many such trivial to bypass ways of doing root detection and most are easily circumvented anyway.