The HSBC app refuses to work if "Bitwarden" is installed on user's Android phone

https://twitter.com/nixcraft/status/2006133658495656377

by fortran77 • 7 months ago

38 24 7 months ago

twitter.com

fortran77• 7 months ago

I think it may be because of a sideloaded app. That does seem like a more reasonable thing to warn about.

wryoak• 7 months ago

Warn? Yes. Refuse access? No.

I would close my bank account over this. That’s not saying much though because they literally pay you to open new bank accounts these days…

walthamstow• 7 months ago

If you cared even slightly about the app, you wouldn't have a HSBC account anyway, you'd have Starling or Monzo or maybe Revolut

tim333• 7 months ago

If the sideloaded app manages to hack HSBC and steal the customers money they are going to have a demand to refund the customer a bunch of money. I can understand their position.

wolvoleo4• 7 months ago

Yes the problem is when all banks start doing this BS though.

unixhero• 7 months ago

This is a freedom we have on Android

JumpCrisscross• 7 months ago

Previous discussion: https://news.ycombinator.com/item?id=46431453

jqpabc1234• 7 months ago

why does Google even allow HSBC to see the list of other installed apps?

Maybe because Google and it's products have little respect for user privacy?

Have you thought about using Aurora Store? You can usually see a list of the permissions the app requires before you install.

mindcrash• 7 months ago

Maybe because Google and it's products have little respect for user privacy?

That's incorrect. Querying installed apps has been severely restricted (and thus mostly useless) and also requires a special nuclear-scale permission since Android 11.

I am wondering what exploit HSBC is using because I really don't think they are using official APIs for this.

jqpabc1234• 7 months ago

I am wondering what exploit HSBC is using

Why was querying installed apps ever allowed? Why is an exploit or permission available now?

Answer --- see the original post above.

wolvoleo4• 7 months ago

Still, I have had issues with this too. My work uses an antimalware app when you use BYOD. Fine, but that app (lookout for work) installed in the work profile, and it complained that I had a tracking blocker (trackercontrol.org) installed in the MAIN profile :( This really pissed me off. Not only is an app in the work profile not supposed to even look at what I've got installed on the personal side, but it's actually a legit app. There's nothing wrong with tracker control. And it comes from a legit source, the Oxford university. The lookout guys are just being obstinate blocking it.

alex1115alex• 7 months ago

The QUERY_ALL_PACKAGES permission (what an Android app needs to see all the packages installed on your phone) is a little weird. The user doesn’t get prompted and explicitly grant permission for it like they would for something like MICROPHONE- having it in the app’s manifest alone is sufficient to query packages. However, Google Play Console does make you submit a video of how the permission is used in your app in order to publish on Google Play if they detect it in your manifest.

The acceptance criteria made sense for our app (it displays your phone’s notifications on your smart glasses HUD, and users need a way of selecting which apps can/can’t display notifications). I don’t know how HSBC justifies it though.

burnt-resistor• 7 months ago

It only works when narco-trafficking money laundering apps are installed.

That's why it doesn't work.

vrighter3• 7 months ago

mine doesn't work because of kde connect, and an open source keybooard i slightly modified and rebuilt myself

parlortricks• 7 months ago

What keyboard did you modify and why?

vrighter3• 7 months ago

I use a keyboard called PentiKeyboard. It's a chorded keyboard. It allows you to place 6 buttons (shown in outlines) overlaid on top of the whole screen.

It had 2 features I wanted to remove. If you swipe in empty space, you can use it to adjust the screen brightness. I kept triggering this accidentally and each time it disabled auto-dimming on the system. And the other feature is that when the keyboard is open, the volume buttons are repurposed, I wanted them to remain working normally.

The HSBC app refuses to work if "Bitwarden" is installed on user's Android phone

Related Stories