search

PrivSec-dev / banking-apps-compat-report

Report and track banking app compatibility with GrapheneOS, including which workarounds may be required.
https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
82 stars 4 forks source link

Starling Bank - Mobile Banking #39

Closed shompoe closed 2 years ago

shompoe commented 2 years ago

Is there an existing issue for this?

App name

Starling Bank - Mobile Banking

Link to app

https://play.google.com/store/apps/details?id=com.starlingbank.android

App version

2.41.2.63454

Country of the app

United Kingdom

Device

Google Play installed

Google Play services Network permission revoked?

SafetyNet Enforcement

Native code debugging

Stock OS compatibility

Profile app tested in

Description of the app's functionality

Everything works except mobile wallet, which relies on gpay. Notifications work if Google play services are installed.

When you select the card screen there is a message about granting permission to Google play services but this can be ignored.

Are there any extra notes you think users should know about?

No response

ADB logcat of the app if necessary

No response

add1989 commented 2 months ago

To confirm, I am running GrapheneOS on a Google Pixel 6 and I am currently unable to access app version 3.55.0.100330. I have just sent an email to help@starlingbank.com and will report back when I have had a response.

nonalloc commented 2 months ago

@add1989 Thank you.

I have asked for any policies / T&Cs they may have regarding device support. They have sent this link, which is largely irrelevant.

They also appear to imply that whilst they don't support GOS officially, they are looking to provide a fix, but "cannot guarantee that access can be restored".

image

Mazeeni commented 2 months ago

Hello. Also receiving the same issue with the newest version of Starling Bank on Pixel 7 Pro. I'll also contact support to try push for a fix. It's a real shame I can't access the app at all right now.

@nonalloc did you downgrade by installing via Aurora Store? Are there any issues with this given I've installed the app through playstore?

nonalloc commented 2 months ago

@Mazeeni Thanks for doing that.

Yes, I downgraded by installing via Aurora Store.

As far as I am aware, you cannot downgrade directly. You'll have to:

  1. Uninstall the current version of your app
  2. Go to Aurora Store, look up the app
  3. Tap on the three dots in the top right corner
  4. Tap on "Manual download"
  5. Type in 99955 to install v3.54.0.99955
  6. Open the app and log in again
nonalloc commented 2 months ago

In the meantime, it appears they released v3.55.1.100703 and everything works as expected now. I no longer get a warning regarding failed security checks.

User1966 commented 2 months ago

Latest version 3.55.1.10073 allows me to login on my GrapheneOS pixel device. Version 3.56 I am told wasn't released. Emphasis added "We are hoping we don't need to do a fix for graphene issues anymore, but we can't guarantee it may come up again."

"If that happens we will look into this, so please let us know as soon as possible if it does" Emphasis added

Asked about hardware attestion again. "For all our customer's security we do not share information about our application security details."

add1989 commented 2 months ago

Can confirm I am now able to access again with app version 3.55.1.10073

ivstiv commented 2 months ago

Here is the response I got as well:

Not to worry, Starling was aware of the issue with the recent Graphene OS update and I'm happy to inform you this issue was resolved swiftly by our specialists earlier today.

You are now able to update your device to the new version of Graphene OS 3.55.1.100703 without any issues.