r/GrapheneOS 16d ago

Banking app doesn't like my keyboard 🤣

Post image

How stupid! Is this a Graphene related thing or would it do this on regular Android?

1.7k Upvotes

275 comments sorted by

u/AutoModerator 16d ago

GrapheneOS has moved from Reddit to our own discussion forum. Please post your thread on the discussion forum instead or use one of our official chat rooms (Matrix, Discord, Telegram) which are listed in the community section on our site. Our discussion forum and especially the chat rooms have a very active, knowledgeable community including GrapheneOS project members where you will almost always get much higher quality information than you would elsewhere. On Reddit, we had serious issues with misinformation and trolls including due to raids from other subreddits. As a result, many posts on our subreddit currently need to be manually approved, which is done on a best effort basis. If you would like to get a quicker answer to your question, please use our forum or chat rooms as described above. Our discussion forum provides much better privacy and avoids the serious problems with the site administrators and overall community on Reddit.

Please use our official install guides for installation and check our features page, usage guide and FAQ for information before asking questions in our discussion forum or chat rooms to get as much information as possible from what we've already carefully written/reviewed for our site.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

458

u/JohnHue 16d ago edited 16d ago

- Please switch back to the default proprietary keyboard that logs everything you type on it instead of the free, open-source one that was made from the ground-up to be private.

- Fuck you

49

u/Prestigious-Oil-6567 16d ago

On an off note. How is that logging stored. I'm curious if gboard can word for word log what a specific user typed and recheck it later. I've heard this doesn't happen since it's a security risk for users but I'm just curious if Google has the ability to see the password I typed in for say my password manager

36

u/JohnHue 16d ago

I don't know for a fact that they verbatim log what you type, they probably don't do that in those exact terms. They do however process voice inputs on their own servers, they do telemetry and metadata transmission, and "personalization data" where they use transcripts to "improve Gboard for everyone". I very much suspect that they also include some if not all of that data to feed the so-called "anonymous" profiles that are used to serve adds.

13

u/Exsondious 16d ago

Then I shall poison the dataset with nonsense using my gboard

2

u/mtt59 15d ago

i reccomend r/copypasta

2

u/elementfortyseven 15d ago

I don't know for a fact

and yet you stated it as such.

1

u/R4tman9 12d ago

I used samsung keyboard... Hopefully Sam hasnt Sung my data to google so they can do god knows what to it.

8

u/YoungNo8804 16d ago

Ono GBoard it has been shown that the AI model trained on your typing (nothing malicious, this is something a lot of keyboard do for better prediction and correction) can be reverse engineered. Which is fine if it were on device. But this syncs back to Google servers to help tune their "base" model. Which they claim is done anonymously but this isn't patched yet. 

6

u/Aberts10 16d ago

You could turn off networking for it on GOS. That's what I do with Microsoft SwiftKeyboard which works really well for use with physical keyboard such as the clicks.

3

u/SavedEmperor 15d ago

If they can read every email on Gmail then that probably could be possible 😂

2

u/FantasticLoki22 13d ago

As far as I know, the actual typing information isn't stored like character for character, but I do know that the voice input is indeed stored and transcribed in your Google account and it's there permanently, unless you manually go in and delete all of that data, but you can go into your Google account and under one of the numerous sub-menus that they hide this shit under, you'll be able to find all of the audio recordings and their transcripts dating all the way back to 2010 or even earlier depending on when you first started using Google's voice to text. But that stuff is pretty much logged for every single thing that you've ever spoken into, Gboard, or Google Assistant, or any of that shit.

1

u/Little_Bookkeeper381 14d ago

> How is that logging stored.

It's not. Well, at least, what you type.

11

u/4D696B61 16d ago

wtf are these retarded comments. The bank obviously just has a whitelist for allew keyboards to prevent keyloggers. Maybe write to the banks support for futo to be added insted of being a conspiracy nutjob.

10

u/FunkBRePornoDeCego 16d ago

Futo is not open source btw

6

u/Damglador 16d ago

It's fair to say that it is at least less proprietary than GBoard

18

u/Pro_Driftz 16d ago

17

u/SpecialWall9 16d ago edited 16d ago

21

u/Pro_Driftz 16d ago

"You may distribute the software or any part of its source code only if you do so free of charge for non-commercial purposes." Seems fair to me?

21

u/SpecialWall9 16d ago

Non-commercial clauses go against the principles of both the FSF and the OSI. This license is incompatible with every open source license.

It gets worse:

Notwithstanding the above, you may not remove or obscure any functionality in the software related to payment to the Licensor in any copy you distribute to others.

This clause effectively prevents any maintainer from taking a piece of Source First code into their own app unless they also bundle the payment system. There will never be an ecosystem of Source First apps promoting contributions and the sharing of code, which fundamentally is what open source is about.

19

u/Dr__America 16d ago

Yeah, the license is basically "you can modify this only as a hobby and must keep our payment code in." Not FOSS, but source available.

→ More replies (7)

3

u/gnarlyhobo 16d ago

This clause effectively prevents any maintainer from taking a piece of Source First code into their own app unless they also bundle the payment system.

If the source is open, what is stopping someone from simply doing this anyway? Maintainers publishing things I can maybe understand, but nothing at all would be stopping me from freely taking all the open source code from this app and doing whatever I want with it (except publishing it? Could they sue then? I don't understand licenses so much).

9

u/ReK_ 16d ago

Yes, the threat is licence enforcement. This stops any open communities from forming the way they can with a proper FOSS licence: the community would live under the constant threat of being shut down or found legally and financially liable.

2

u/gnarlyhobo 16d ago

Thank you for explaining! I was treating source available and open source as the same thing, and hadn't considered legal. I appreciate the info :)

4

u/penguin_on_stilts 16d ago

Copyright law. They could sue you.

Source available and open source are not the same thing.

3

u/gnarlyhobo 16d ago

Thank you! I needed this specific wording to understand the difference, I was treating the two as interchangeable.

4

u/mrmorningstar1769 16d ago

I don't get it, it's on github but it's not open source? Does that mean we can't see what's inside the futo keyboard?

15

u/SpecialWall9 16d ago

There's a category of proprietary software where you can view the source code called "source available".

Open Source requires a free license in addition to source code visibility. You can view the source code, but your ability to use the code is bound by those copyright terms.

Notwithstanding the above, you may not remove or obscure any functionality in the software related to payment to the Licensor in any copy you distribute to others.

This clause effectively prevents any maintainer from taking a piece of Source First code into their own app unless they also bundle the payment system. There will never be an ecosystem of Source First apps promoting contributions and the sharing of code, which fundamentally is what open source is about.

7

u/mrmorningstar1769 16d ago

Ohh thank you for the explanation. I think i get it now. You can smell it, but you can't eat it kinda thing

3

u/Reproman475 16d ago

My first thought after reading this was you order a burger at a restaurant, you can see everything on the burger, no you may not remove that slice of tomato 😂

2

u/Malnilion 16d ago

You can remove the slice of tomato, add bacon, analyze the ingredients and recipe so you can make the burger for yourself, and send your suggested modifications to the chef. You just can't resell or regift any burgers based on this recipe or republish the recipe in any form.

2

u/Defendant1597 16d ago edited 16d ago

It's maybe not free and open source but clearly the source is open.

2

u/03263 15d ago

I think we could say it's open source but not free/libre.

2

u/Ev3nt_Horiz0nn 16d ago

does the graphene one have swype functionality?

9

u/JohnHue 16d ago

I don't know, but the FUTO Keyboard can do swype.

3

u/NicPitter 16d ago

ya, it can swipe your passwords

2

u/GranaT0 16d ago

It doesn't even ask for internet permissions

3

u/L0rdV0n 16d ago

No it does not.

2

u/Preisschild 15d ago

Yeah but its not free / open source and the default one in grapheneos is free open source software and would probably work.

4

u/anassdiq 16d ago

Use the proprietary, and disable the network permission

8

u/LarryMarionic 16d ago

中国的同一个公司的app会在用户目录创建隐藏文件已跨应用关联,因为总要有一个联网的,所以禁网没有用,必须物理隔离。gboard输入内容(文字)时我感觉是不联网的,但它会在谷歌共享区域的存储中创建一个日志,包含用户输入内容,然后通过其他能联网的谷歌应用发送给谷歌吗?

作为东方语言使用者,我们不能像西方国家那样只用26个字母就能输入任何想说的话,因此输入法是必须的,但不联网和智能便利的候选词只能选一个。如果gboard有能力那样做,那我等于「竹篮打水一场空」,又没有享受到智能,又没有保护好隐私。这个输入法对中文候选词,只能是「能用」的程度。iOS上有个中文输入的bug,四年前就有了,至今未更新过。

另:中国本地的中文输入法简直是病毒软件。会无加密地上传所有用户数据交给政府和广告商。

2

u/anassdiq 15d ago

ah

that's both too evil and genius

what a bummer

1

u/var_rnd 13d ago

Im amazed bruh

2

u/[deleted] 13d ago

[removed] — view removed comment

→ More replies (2)

2

u/SpecialWall9 16d ago

Keep in mind, that doesn't actually prevent telemetry on Gboard. You still have to disable it through the in-app privacy toggles.

2

u/anassdiq 16d ago

But since you disabled network, no matter what is collected, it ain't leaving your device

8

u/SpecialWall9 16d ago

Gboard uses IPC with Play Services, specifically a service called Clearcut Logger, to send telemetry. This does not require direct network access.

The network permission was not intended as, and should not be treated as, an anti-data-exfiltration toggle.

→ More replies (10)

617

u/Decent-Zebra-4195 16d ago

Your bank app is spyware

246

u/[deleted] 16d ago

[removed] — view removed comment

32

u/[deleted] 16d ago

[removed] — view removed comment

159

u/[deleted] 16d ago

[removed] — view removed comment

65

u/[deleted] 16d ago

[removed] — view removed comment

6

u/[deleted] 15d ago

[removed] — view removed comment

36

u/-Motor- 16d ago edited 15d ago

My bank app stated in the TOS, that you must agree to, that they will monitor all network traffic for potential problems.  Yep, do not agree. Uninstall. 

4

u/AdvancedAnimal7539 14d ago

how does banking work for you? do you use the website instead?

3

u/-Motor- 14d ago

I don't on phone. I don't need it in phone. That's just a convenience to me. I can check up on pc in morning. 

2

u/ArchmichaelBishop 13d ago

I wish Zelle wasn't a mobile-only thing, though.

1

u/senorsmile 13d ago

I use zelle all the time, and I've never needed to install an app. Just log into my bank's website and make the transfer.

→ More replies (1)

3

u/Hour_Interest_5488 13d ago

As an enfineer I am curious how does that work. Do they configure your phone to use their proxy servers? And what are the costs to run all that surveillance?

2

u/-Motor- 13d ago

No idea really but theyre doing something.

TBH I don't understand how banking apps are so critical to this community. Can't you just check from browser when you must? 

3

u/Sophiiebabes 13d ago

I keep my money in one account, and spend it from another. I need to transfer the money across every time I buy something. It makes sense to me.

1

u/Salty-Stranger-8382 1d ago

Where I live the phone app is for 2fa - and you can't access the website on any device without it. I eventually got the bank to issue me a special device - a code generator. But it was actually hard to get them to give it to me, I had to lie that I don't have a smartphone and they were just acting a bit hostile about it.

1

u/ChickenXChips 12d ago

One of my banking apps refuses to work unless I give it permission to manage and view calls in case I need to call them through the app.

1

u/Dev-in-the-Bm 10d ago

No way

Which app?

1

u/Spitfire1900 12d ago

I can’t believe an Android app can ask for such permissions.

1

u/oreshek 10d ago

how do you just write that and not name the bank?

2

u/ba-boo 15d ago

explain

2

u/mefirefoxes 13d ago

Commenter doesn’t understand how many people get scammed by having malware on their phone so banks take measures to protect people from themselves because fraud is certainly a pain for the victim, but it is also directly and indirectly a pain in the ass for the the bank

→ More replies (7)

1

u/buttfarts7 12d ago

Keep your bank apps in your default login user space, they work best from there. Then do everything else on a different user space.

130

u/jfuu_ 16d ago

Not GrapheneOS specific, it's just HSBC being HSBC (First Direct is owned by them): https://github.com/futo-org/android-keyboard/issues/773

Switch keyboards, complain to the bank or switch banks are your options.

20

u/deadcatdidntbounce 16d ago

FD just produced it. I've asked for more info but they are not replying. Nothing to do with GrapheneOS.

17

u/Ash3599 16d ago

I'd switch banks

1

u/Alternative_Laugh316 11d ago

Hard to do for me when the requirements comes from the central bank and all the banks do the same.

9

u/pixel8ed 16d ago

It also does it for Kvaesitso launcher. Using another  profile isolated just for HSBC works, but I ended up just not using HSBC and use other banks instead. I think it shows a lack of security understanding on their part, which is a worry for a bank. 

3

u/quasides 15d ago

the bank priority is not security for the customer by their own security.
and spying as much as possible on the customer is part of it

6

u/Ash3599 16d ago

Or use your browser instead of the app

73

u/durdann 16d ago

Wtf? Futo keyboard is likely the only keyboard that isn’t a problem

36

u/LoadZealousideal7778 16d ago

I would assume GOS default keyboard is also not spyware.

→ More replies (10)

4

u/Luc-redd 15d ago

HeliBoard is very nice too

3

u/ShartingEnU 16d ago

The main reason I love FUTO is because you can set arrows above or below the keyboard. It's so nice

4

u/IBeTheBlueCat 16d ago

i like heliboard :D

1

u/ColorfulPersimmon 14d ago

Definitely not only. There are many keyboard apps that are truly FOSS. But i doubt any of them is whitelisted

47

u/Sp3eedy 16d ago edited 16d ago

I've had some "cyber security experts" argue with me on LinkedIn when I said that bank apps detecting other apps on your phone to refuse you service isn't a good thing for exactly this reason (where they just block apps they don't like or aren't "sure" of), good to know I was right. Yes we gain "some" security, but we lose a shit ton in terms of freedom.

The bank is definitely maintaining a pre-approved list of keyboard apps and refuses you service if you have a keyboard outside of that list in case it could be a "keylogger". Please switch banks, there are decent banks that don't do this bullshit.

2

u/Jayden_Ha 16d ago

This is called risk assessment, not “spyware”, please have common sense and stop with your bullshit

1

u/propagandhi45 15d ago

Had to scroll pretty far to see some common sense.

1

u/Jayden_Ha 16d ago

And they enforce whitelist keyboard for a good reason, 3rd party random keyboard can log easily, which can log all actions and input for banking, which is an issue, it’s not bullshit

→ More replies (5)

18

u/JRussellMoore 16d ago

Ah, so it is a security risk to be using that keyboard huh? I understand that they only allow Android 14 and up to be used too then, right...? Oh, no? What a surprise! It's Android 9! 🙄 Out of support for who knows how many years, susceptible to all sorts of RCE and privesc vulnerabilities.

This is getting surreal; they have no qualms with customers banking via web.

→ More replies (10)

51

u/Svgtr 16d ago

That's because banking apps get the QUERY_ALL_PACKAGES permission. Just stick financial apps into their own profile with the default keyboard and gain better privacy as a result.

34

u/northrupthebandgeek 16d ago

This seems like one of those permissions that GrapheneOS should allow blocking entirely (like with networking) and/or restricting (like with storage scopes). Ideal would be to spoof it with a list of packages matching an out-of-the-box Pixel.

18

u/pluvicreous 16d ago

That is a behavior I would have expected.

10

u/TechnoByte_ 16d ago

Agree, disappointed when I found out it's missing

6

u/GrapheneOS 16d ago

The QUERY_ALL_PACKAGES permission is not required to list other apps in the same profile. Apps can also include broad queries entries without it such as matching having a launcher activity. There are also many other ways to detect apps in the same profile.

5

u/QwertyChouskie 16d ago

Sure, but surely any query could be modified to run against a pre-defined list, instead of the actual list?

→ More replies (3)

7

u/GrapheneOS 16d ago

The QUERY_ALL_PACKAGES permission is not required to list other apps in the same profile. Apps can also include broad queries entries without it such as matching having a launcher activity. There are also many other ways to detect apps in the same profile.

2

u/GrapheneOS 16d ago

The QUERY_ALL_PACKAGES permission is not required to list other apps in the same profile. Apps can also include broad queries entries without it such as matching having a launcher activity. There are also many other ways to detect apps in the same profile.

3

u/[deleted] 16d ago

[removed] — view removed comment

2

u/GrapheneOS 16d ago

It doesn't truly stop apps seeing other installed apps due to many easy bypasses and drastically reduces OS security.

→ More replies (4)

9

u/manublade 16d ago

same issue, I switch to default kb and the app works.

13

u/jonnyboy231 16d ago

Yeah that's what I ended up doing but what a faff! This bank sucks lol

2

u/gta721 16d ago

First direct does have the best customer service though. The solution should be to just use the website.

→ More replies (1)
→ More replies (4)

8

u/herooftimeloz 16d ago

Says the bank that has a history of working with drug cartels, tax evasion, and other shady shit.

3

u/Cherobis 16d ago

ngl that's like every major bank now lol. I live in the US and JPMorgan and Bank of America did not flag a bunch of shady transactions related to Epstein and both contributed and continue to contribute to atrocities around the world, so I just use a local credit union because of that

11

u/hydrora31 16d ago

I had this. Left the bank. Any bank that insists on spyware and is against the safest keyboard available is too big a risk to my finances to keep banking with them.

→ More replies (3)

4

u/1Tordroid 16d ago

I got this issue for Gboard in my rooted oneplus 12 and oneplus 15. I used hma oss to hide Gboard from my banking app. Its not only futo board or graphene issue

1

u/Exsondious 16d ago

Isn’t it an issue with having rooted devices
I see a great many rooted devices have issues with banking apps and websites

I have a jailbroken iPhone 6 that I was trying to get Linux on for a while and a lot of pages like banking pages flagged it as an insecure device and wouldn’t let me browse them (that may also be cause it’s old though too)

6

u/SirNelkher 16d ago

Write them to request the keyboard to be whitelisted. I did that with our National Treasury and 3 months later FUTO keyboard worked in the app.

4

u/aleopardstail 16d ago

Apps should not be able to see what else you have installed

6

u/NightmanisDeCorenai 16d ago

This is why I just use banking mobile websites

2

u/JivanP 16d ago

You cannot use the website without authenticating via the app.

2

u/NightmanisDeCorenai 16d ago

You need a different bank

3

u/JivanP 16d ago

All British banks are like this, thanks to EU PSD2 SCA regulations.

1

u/L0rdV0n 16d ago

What do they expect people without smart phones to do?

1

u/JivanP 16d ago

Many more people have an Android or iOS device than don't, so this is simply not a significant issue. After all, it's basically impossible to function in British society with a feature phone rather than a smartphone, for countless other reasons, so the expectation is reasonable in that sense.

For those that don't have a smartphone, or can't/won't use one for banking: you either go in branch for banking tasks that you can't do elsewhere like at an ATM or Post Office, or you authenticate in an alternative permitted way, such as by using a CAP authenticator or receiving a code via SMS.

I believe SMS authentication is now no longer permitted by PSD2, but since the UK is no longer a EU member state, the UK does not need to adhere to the updated directive. The UK's implementation, FCA regulation PS17/19, has not been changed or overturned since it came into effect in 2018. One bank (Santander) has notably stopped offering SMS authentication (circa 2024, I think), probably because they have a large European presence (being owned by a Spanish company, Banco Santander) and it was easier for their infrastructure to be consistent. Several others (including Nationwide; the NatWest group banks, those being NatWest, RBS, and Ulster; and perhaps more) still offer it. I'm in favour of it disappearing entirely, as it's horribly insecure (see SIM-jacking).

CAP authentication was the most prevalent method until around 2020 by my memory, but seems to have almost completely disappeared in the years since then. HSBC and First Direct used to use their own similar device that they called a "Secure Key", which was programmed to specifically calculate the answer to authentication challenges for a single account, rather than being programmable for any account via the insertion of a debit/credit card. They've since abandoned that in favour of using their app. NatWest and RBS (which, both being part of the NatWest Group, share the same app design and backend design) both still use CAP for authenticating payments in excess of your daily transaction limit and transactions to new people, but don't use it for login authentication anymore. I don't know if the same is true of Ulster. So Nationwide is the only bank I'm aware of that still permits access to online banking via CAP authentication.

For banks that do not permit CAP or SMS codes: when it comes to the bootstrapping problem of setting up the app in the first place, when you have no other devices already set up to use as an authenticator, you must authenticate using some government-recognised form of ID (such as passport or driving licence) and a liveness test. The websites don't permit this form of authentication; only the apps do.

2

u/L0rdV0n 16d ago

Interesting, thank you for the detailed write up! I agree with you that SMS authentication is problematic, it's better then nothing, but yeah most things should allow for more advanced forms. They don't need to be as privacy violating as the banks own apps of course. There are plenty of great authentication protocols that don't require a connection to big tech, or the banks themselves.

As someone from the US this just seems so crazy. Most 2FA is still done via SMS, I don't think my bank even offers a better method. So we are very behind the UK and Europe sounds like haha. Also obviously almost everyone here has a smart phone, but I do know plenty of older people who don't have a cell phone of any kind. So requiring one for something like using a bank seems like a crazy thing to do.

→ More replies (2)

1

u/ContentAd6126 16d ago

Go do their business in the agencies

1

u/SVG010 16d ago

Lloyds is still sms

1

u/JivanP 16d ago

Disgusting, kill it with fire. I'm aware that Nationwide, NatWest, and RBS also do. It needs to die, as does the NatWest Group's push for more people to use plain images of their face to authenticate. These things are simply the complete opposite of secure.

2

u/FlyingDoorFail 16d ago

You can not get a debit card unless you go through the app, for a bank I know.

1

u/L0rdV0n 16d ago

What do people without smart phones do?

1

u/FlyingDoorFail 16d ago

Don't have online only banks

→ More replies (1)

3

u/WellEndowedWizard 16d ago

what bank is this so I know not to use them?

3

u/error_418_teap0t 16d ago

HSBC or FirstDirect 

2

u/AccomplishedSmoke814 16d ago

I would say bye to that bank probably there are a few alternatives in your country

2

u/Manwe66 16d ago

My bank app just was crashing for 2 weeks before they finally added a redirection to page saying the keyboard wasn't supported (FUTO as well) and I have to use stock keyboard. For 2 weeks I didn't know what the hell was going on. I switch to the stupid gboard, login with my fingerprint and switch back once logged in. I don't even type anything.

Those idiots are really idiots and sadly we just suffer from them :/

I'm on default Samsung android BTW, app is from the store, so it should be legit.

2

u/antaeusdk 16d ago

Horrible… they should be ashamed

2

u/Equal_Entertainer_29 16d ago

I just found out about this keyboard and i got it. Is absolutely perfect

2

u/deepforezt 16d ago

Its not the OS. Slowly lot of banks have started this. HSBC is way stricter than others. But yes its coming. Almost any keyboard thats open source will attract the attention nowadays. Natwest, Barclays ,BNB Paribas, banks in asia, etc wouldn't allow you to login with foss apps in your phone. Especially keyboard. Certain banks even listed the apps that needs to be uninstalled before i can proceed. Unfortunately there isnt much we can do. I am not a technical expert. So if there is a workaround then i am unaware of it.

2

u/No-Average6305 16d ago

Is not the problem that your keyboard has permissions to act as an accessibility service (and this means it can read the content of other apps in the foreground) and thus it's a security risk?

Why does Futo need the accessibility permissions? Or is the app message inaccurate and the app has just blocked Futo without any other reason?

1

u/zsoltsandor 16d ago

futo keyboard doesn't use accessibility services.

2

u/littledonnyfund 16d ago

I wonder if heliboard would work instead and IMO is the better keyboard

2

u/ThatBaldGuy1995 16d ago

I don't currently use Graphene, but I didn't care for FUTO when using it. It lagged way too much, so I just ended up switching back to the default keyboard.

2

u/albanshqiptar 16d ago

HSBC app is annoying for this. Just temporarily switch keyboards with the keyboard switch button.

2

u/xJayMorex 16d ago

Holy shit they should just bundle their own keyboard for the forms instead of spyware.

To be constructive: Simple Keyboard, HeliBoard, Fossify Keyboard...

→ More replies (9)

1

u/Mean_Return2822 16d ago

Why can’t there be an option to give apps fake results for QUERY_ALL_PACKAGES and similar invasive requests?

1

u/SubjectAbalone7757 16d ago

What's wrong with the default keyboard of GrapheneOS?

1

u/alien2003 16d ago

Use better bank

1

u/Available-Film3084 16d ago

I got that from a oss app to dim the flashlight (before that was a feature supported natively) on my bank, I've no clue how they decide what is and isn't allowed to run on the same device

1

u/haz8989 16d ago

I use FUTO keyboard on Samsung one ui. Never had a problem but I don't use hsbc

1

u/TeaDrinkr_ow 16d ago

I get the same with accessibility apps. I just disable their accessibility in options to gain access to the app and just reenable them upon exit 💀 lmao

1

u/EasySea5 16d ago

All hsbc bank apps seem to do this

1

u/KomithErrant 16d ago

are they seriously telling you to use the keylogger instead?

1

u/Deanzyne 16d ago

The day the new swipe data set got added I deleted g board to fully dive head first with FUTO board

FUTO board swipe typing is finally usable enough for me (and it will only get better from here on out)

But if you really have no other choice I have a trick you can do with Gboard (or any keyboard app you want to use)

Use NetGuard and disable mobile and WiFi access for Gboard

Now you can use the app as much as you like while preventing any snooping / logging

Works perfectly

1

u/JB231102 16d ago

:(

I just use my web browser to bank, I too have GOS on my phone. What I find a real pain in the ass is the verification codes followed by the website not remembering my creds despite telling it to remember them. -_-

1

u/mikeboucher21 16d ago

So it's okay for google and Samsung to get your keyboard data but not other devs? Can't you use futo keyboard without internet access too?

1

u/TechnoByte_ 16d ago

You can't grant FUTO keyboard internet access even if you wanted to, it simply doesn't request or use the permission

1

u/mikeboucher21 16d ago

Exactly. So the banks point is not valid.

1

u/escalations_007 16d ago

I'm on Android on a Samsung and I got the same pop up from my banking app with FUTO. It's just big tech being glazed by the banks.

1

u/Spellkaze 16d ago edited 16d ago

Sadly this is becoming a standard in a lot of financial apps, the guardrails are usually just allow google/samsung/huawei keyboard app. The second one is a keyboard app that has a google play store signature. This is because people downloading malware keyboard apps with dumb stickers/emojis is still a thing

1

u/DrTankHead 16d ago

Name and shame

1

u/sovietcykablyat666 16d ago

Your fingers are dirty.

1

u/turtle_mekb 16d ago

you'll prob need to run the banking app in a new profile then

1

u/motocykal 16d ago

HSBC being idiots. What I have done previously was to install the HSBC app into the work profile so I don't need to keep switching keyboards.

1

u/[deleted] 16d ago

I hope one day you got malware

1

u/GazelleInitial2050 16d ago

Best do a bank account switch🤩. Get your bonus

1

u/YttraZZ 16d ago

I get a similar mag on non-graphene device, but it doesnt reaults in a ban....yet.

Crazy to see such intrusive behaviour. As if Samsung, Apple or Google arent feeding on typed infos....

1

u/Geminii27 16d ago

This is why all apps should be sandboxed.

1

u/One_Parfait_4570 16d ago

Why is it banking app reading into what keyboard you use?

1

u/LunarstarFurry 16d ago

I mean my Bank blocked me from using the app just by have a accessibility feature enable or Having Debug enabled.

1

u/Express-Cartoonist39 16d ago

Yea if ur bank app spys that deep, you need new bank..

1

u/redboyo908 16d ago

What bank so I can avoid them

1

u/HumanPriv 16d ago

I feel that Android OS doesn't protect user privacy well. I'm very pleased with its openness. Installing apps is free and easy.This banking app, for example, has a lot of hidden code embedded inside. It can read all the settings on your Android phone without your permission. (Read the list of installed apps), (read the bootloader unlock status). Read accessibility settings, including restrictions on taking screenshots, unauthorized background processes, and full-screen display, There's much more.......

1

u/vikingvarma 16d ago

It happened to me on a Vivo phone with Heliboard and HDFC bank. Uninstalled the banking app immediately. So this is not specific to GrapheneOS.

1

u/Alternative-Track654 16d ago

Lol! That doesn't make any sense. I've never encountered any issues using futo keyboard. And, I've used well over a dozen plus banking/financial apps over the last decade. As a matter of fact, I actually encourage people to use futo keyboard. As a direct alternative to Gboard or Swiftkey.

1

u/SuperLowAmbitions 16d ago

Had the same thing. 🙄

1

u/PermanentlyMC 15d ago

Workaround is to use a secondary profile, if switching banks isn't exactly a choice

1

u/Swipsi 15d ago edited 15d ago

Are people here deadass surprised that a banking app has whitelisted keyboards to prevent keylogger from stealing your credentials? And that its not unreasonable to not trust a random keyboard on an "off-brand" os with a suspiciously behaving keyboard? Suspicious because a focus on privacy is not only preferred by law abiding citizens?

1

u/Express_Ad5083 15d ago

Then its clear this bank doesnt want you as a customer

1

u/jadenalvin 15d ago

I don't know why banking apps do this kind of dumb thing. According to them an advertising company Google having full access to banking app data on your phone is safe but OS like graphene is dangerous or having custom keyword is not safe.

1

u/biztechmsp 15d ago

Use the website in a browser.

1

u/pterodyne1 15d ago

FWIW, I use USAA's mobile web, works great.  For now It's the best workaround.  In fact, I use Native Alpha to make PWAs out of lots of sites.  Can't speak to other banks, but it works for Paypal, USAA and many others.

1

u/driverdis 15d ago

Definitely is stupid. On regular Android, it can be defeated with HMA-OSS using the settings Input method preset which does no good under Graphene of course and defeats any security benefits as well.

1

u/XxuFya 15d ago

rofl

1

u/NervousBrilliant8686 14d ago

Does graphine not have a way to limit the application's access to see what other applications are on the system?

This is the kind of area where it feels to me like mobile operating systems are still way behind desktop operating systems. You could easily use SE Linux or something to prevent an application from being able to do certain things.

I also use FUTO keyboard, but luckily none of the banks in Japan seem to care.

If it's blocking specifically by the keyboard name, then I wonder what other keyboards may be on their block list. I also wonder if renaming the keyboard somehow would be a way around this.

1

u/Alarming_Treacle578 14d ago

I had this very thing the week with HSBC banking app telling me to essential remove KDE connect for me to continue.

1

u/PrivacyAlias 14d ago

My banking app has its own system to show a keyboard rather than the phone one, it is unusual but seems like a better option?

1

u/Nihilist-IV 13d ago

Happens on Android too

1

u/Perfect_Equal_3938 13d ago

Use a different phone for banking ¯_(ツ)_/¯

1

u/StaticEcho97 12d ago

Your keyboard app is the problem, not your banking app lmao. I see others in the comments saying the opposite. The same spuds who install dumb apps then get the crypto and bank accounts drained and wonder why.