A lot of major banks worldwide have apps, and they usually require un-rooted phones.

People here seem to think this is some sort of Orwellian attempt to control them, but the reasons are more mundane and technical - many of them (mine included, from two countries) use security facilities on the phone to secure your accounts.

For example, my HSBC UK app has replaced the little calculator thing they used to ship, and uses iOS face recognition to secure the generation of log-on codes which you need in order to use the web interface, as well as for secure access to the banking app directly.

With a rooted phone they don't have the guarantees that these aren't being exfiltrated, or the app being subverted in novel ways, so they don't want to support it.

You may not consider this a good enough reason, and I have heard it said on HN that 'the banks shouldn't get to control what I do on my computing device!', and that attitude is absolutely fine, but then you'll most likely end up with either less secure banking (meaning more fraud, higher fees etc) or going back to having to have a dedicated security device.

> I can deposit checks through it on my laptop

American-like banking detected... who uses checks in 2025?! :)

▲

hecanjog 16 hours ago | parent | next [-]

> American-like banking detected... who uses checks in 2025?! :)

Yeah, fair. :-) I live in a small town, the only check I write is my rent check, which I literally walk across the street to deposit. But I still on rare occasions receive checks as well.

	▲	Nursie 16 hours ago \| parent [-]
		Ha. Fair enough. That sort of thing is almost exclusively done using bank transfers here in Aus. I did receive one check this year, a refund from a company who had screwed up billing on a medical scan. For some reason they couldn't just refund it to my debit card. It was really annoying to have to get to a bank during opening hours to deposit it, but my bank here doesn't offer mobile check scanning. Some do, my old UK bank did ... oh well.

▲

derbOac 14 hours ago | parent | prev [-]

> going back to having to have a dedicated security device.

... and ...?

There are ways to implement security without tying it to one of two app stores. Companies might even get creative and figure out hardware standards for secure verification that are portable, open, and give the user control. They figured out sim cards, and are worried about GAI they created taking over the entire world, they could figure this out.

	▲	Nursie 13 hours ago \| parent [-]
		> ... and ...? Personally I prefer the device convergence rather than having to have another thing to keep track of. Plus the added factor of biometrics over pure hardware 2FA. But you do you, as they say, the point is there are tradeoffs. > There are ways to implement security without tying it to one of two app stores. It's not just about the app store - people want to be able to run these on rooted devices, which is an end run around the security guarantees these apps currently rely on. > Companies might even get creative and figure out hardware standards for secure verification that are portable, open, and give the user control. I wish you the best of luck in this endeavour. I hope that they already aren't relying on client-side security any more than they have to. I'm afraid I'm not familiar enough with the APIs around biometrics to know if there's a useful way a server can use the onboard devices to verify a user's identity without relying on client-side security in one way or another though. It's true on desktop we have stuff like FIDO2 authentication using hardware tokens, which are supported on open systems like firefox on linux. I'm sure it's not insurmountable or unthinkable to do similar on phones. At the least there would need to be a system of remote attestation for the biometric hardware, and a way for it to provide a verifiable response to a remote server. Far from insurmountable, but someone will need to actually do it. Goes against FOSS still though if there are processors in the system which can't be user-controlled, and biometric chips which perform remote attestation (see the recent discussions on how passkeys are fundamentally OSS-hostile).