PrivSec-dev / banking-apps-compat-report

Report and track banking app compatibility with GrapheneOS, including which workarounds may be required.
https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
69 stars 4 forks source link

Tide - Business Bank Account #206

Closed glidingthrough closed 1 year ago

glidingthrough commented 1 year ago

Is there an existing issue for this?

App name

Tide - Business Bank Account

Link to app

https://play.google.com/store/apps/details?id=com.tideplatform.banking

App version

v3.0.12

Country of the app

United Kingdom

Build Number

TQ1A.221205.011.2022122700

Device list

Pixel 6a

Profile app tested in

Owner profile

Google Play installed

Installed

Google Play services Network permission revoked?

SafetyNet Enforcement

Native code debugging

Exploit protection compatibility mode

Stock OS compatibility

Description of the app's functionality

Loads initially as you would expect, then about 5 seconds in it pops up with a message saying 'Security Lock, for security reasons the Tide app is unable to run on this device, error code: 4', with a contact button at the bottom available to contact their customer support. No other actions are possible.

Are there any extra notes you think users should know about?

I managed to get the webapp working, which has some basic funcationality: seeing balance and transactions, raising invoices, marking them as paid. At the time of writing, I have not tried sending money through the webapp.

Note that I was unable to get the webapp working on Brave, Chromium or Vanadium (they all failed when setting up biometrics for the new login). Firefox was the only one to work for me.

I installed Firefox (using FFUpdater from F-droid), went to web.tide.co, clicked on the Firefox menu and selected install. This installed the webapp. I then opened this to continue to process of adding a new device login.

ADB logcat of the app if necessary

No response

akc3n commented 1 year ago

Thanks @glidingthrough

glidingthrough commented 1 year ago

Update: I managed to get the Tide app to work by downloading it through the Play Store, as opposed to the Aurora Store which I had used previously. It requires the Sensors permission to authenticate your account (for the biometric face check). Very happy!!

glidingthrough commented 1 month ago

I can confirm that Tide - Business Bank Account no longer works on GrapheneOS (Build 2024050700), with or without Exploit Protection Compatibility Mode enabled.

I updated the app to the latest version, v3.67.0, from the Google Play Store and now get the following error before the app quits: REF: 7144:8DE8 2000000 Root bypass detected. Closing app for security.

Tide have been contacted with a link to the Attestation Compatibility Guide in the hope that they will fix it, as I cannot access my bank account without the app.

glidingthrough commented 1 month ago

The good news is that the progressive web app works still, with Bitwarden managing passkeys, so all is not lost 👍

valiantgenomics commented 2 weeks ago

@glidingthrough Having the exact same issue with Tide. Can't even log into the PWA because it requires QR authentication via the app (which is inaccessible).

Tried everything, installed through the Play store instead of Aurora. Both enabled/disabled Exploit protection compatibility. Enabled all permissions.

But nothing works, unfortunately.

How are you accessing your account? PWAs log you out every 30 days or so, and you need to re-authenticate your session, which I assume you can't because you can't log into the app.

glidingthrough commented 2 weeks ago

@valiantgenomics I installed the PWA with Vanadium and managed to login using biometrics, even though I don't have a fingerprint set up it still works because it defaults to the device PIN.

The PWA lets you send invoices, see transactions and send invoices. It does, however, require approval from the app to transfer funds. So I've been bothering their Support staff through the PWA chat function (authenticating for these chats required me to use a Windows computer with Chrome) about the lack of support for GrapheneOS and I've been getting them to do transfers for me, too.

They say they are still investigating the GrapheneOS error, however I've given up on Tide and am now moving my money to Starling thanks to the excellent community support that kept the app working on Graphene - see #39.

A heads up that I was offered £75 compensation by lodging a formal complaint through the chat about GrapheneOS no longer being supported.

glidingthrough commented 2 weeks ago

I will add the the thing I miss from Tide is the free ability to raise invoices, which costs £7/month in Starling. I've therefore switched to Zoho Invoice which is free and means my invoicing ability is no longer tied to the bank I happen to use, which I suspect may be useful going forward. Zoho Invoice has zero known trackers and their privacy policy is good.

valiantgenomics commented 2 weeks ago

@glidingthrough Thanks for the reply! I've already been using Starling for 5+ years, and it's an overall much better bank than Tide. Never had issues with Starling on GOS, and hopefully never will.

The reason why I wanted to get Tide to work, is because they offer the best business savings bank account in the country, with 4.33% (as of time of writing this).

I contacted Tide support today using their generic email support address, and wrote a comprehensive email with everything important from this thread and from Starling's thread.

Hopefully they respond and fix it soon.

Re the invoicing issue. I've never used Starling to create invoices, but FreeAgent. I prefer it to Zoho, but Zoho isn't bad either.

valiantgenomics commented 1 week ago

@glidingthrough Hey, just updated the Tide app now, and it seems to be working fine. I haven't yet created an account but can do so, and the app isn't force closing after falsely thinking GOS is bypassing Root.

Could you please check to confirm, it's working on your end as well?

glidingthrough commented 5 days ago

@valiantgenomics yes, it appears to be working. Thanks for the heads up 🙏