search

PrivSec-dev / banking-apps-compat-report

Report and track banking app compatibility with GrapheneOS, including which workarounds may be required.
https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
87 stars 4 forks source link

Sparkasse Ihre mobile Filiale #44

Closed robovoice1 closed 2 years ago

robovoice1 commented 2 years ago

Is there an existing issue for this?

App name

Sparkasse Ihre mobile Filiale

Link to app

https://play.google.com/store/apps/details?id=com.starfinanz.smob.android.sfinanzstatus

App version

6.45 Build 59280 release-Prod-Server

Country of the app

Germany

Device

Google Play installed

Google Play services Network permission revoked?

SafetyNet Enforcement

Native code debugging

Stock OS compatibility

Profile app tested in

Description of the app's functionality

Checking your account balance Realtime/normal payments

Standing orders

Enable Giropay/Kwitt

Download Mobile Payment App (redirected to download the app from GPlay Store)

Enable/Disable money transfers to IBANs from foreign countries

Find the nearest ATM

Monthly banking statements to download (pdf)

Are there any extra notes you think users should know about?

You need a second (tan) app on the same smartphone for realtime or normal payments. It is called "S-pushTAN". https://play.google.com/store/apps/details?id=com.starfinanz.mobile.android.pushtan

Hardware chipTan is possible, but cannot be activated via the app/online. For this you you have to make an appointment in your local Sparkasse. Device for the chipTan can be ordered here:

https://www.sparkassen-shop.de/home/search/?search%5Bquery%5D=chiptan

For mobile Payment you need another app. https://play.google.com/store/search?q=mobiles+bezahlen+sparkassen+app&c=apps

Here is a detailed guide for contactless (Nfc) payment with Android phones - GrapheneOS and Android Stock: https://www.kuketz-blog.de/nfc-datenschutzfreundlich-bezahlen-mit-dem-android-phone/ (website is german only, but can be translated to english within Brave, Firefox browser ....)

Here is listed which trackers and permissions are used by this app: https://reports.exodus-privacy.eu.org/en/reports/com.starfinanz.smob.android.sfinanzstatus/latest/

ADB logcat of the app if necessary

No response

robovoice1 commented 2 years ago

Also worth to mention: Do not switch to Google Play Store beta within GOS updater app. The bank app freezes on start!

akc3n commented 2 years ago

Also worth to mention: Do not switch to Google Play Store beta within GOS updater app. The bank app freezes on start!

Noted. Thank you for the helpful information you shared. Much appreciated.

PhysicsIsAwesome commented 2 years ago

Also works on a secondary profile without Play Services (Pixel 4a 5g, v 6.0.2). The only thing that didn't work was taking pictures of invoices, because it uses Play Services to access the camera.

You need a second (tan) app on the same smartphone for realtime or normal payments. It is called "S-pushTAN".

This depends on which Sparkasse and which TAN method has been selected. A lot of Sparkasse customers use chipTAN with an extra TAN generator device.

robovoice1 commented 2 years ago

@PhysicsIsAwesome : on the first view the app is working, but you cannot download/view your monthly bank statements (pdf) within the mail account of the bank app. If you try to access your mail account in the bank app the message no google play store installed appears.

Before you could also get hardware tan generators, but they changed it (cheaper?) I tried this when sandboxed google play was not avaiable for Gos in owner profile

PhysicsIsAwesome commented 2 years ago

@PhysicsIsAwesome : on the first view the app is working, but you cannot download/view your monthly bank statements (pdf) within the mail account of the bank app. If you try to access your mail account in the bank app the message no google play store installed appears.

Works fine on my device.

Before you could also get hardware tan generators, but they changed it (cheaper?)

This could also depend on the region. Not every regional Sparkasse is the same. On my region it is still available.

baermathias commented 1 year ago

Mobile payment should be removed from the functionality, because for this you need a separate app, which does not work with GrapheneOS

robovoice1 commented 1 year ago

updated this issue, thanks for reporting @baermathias

robovoice1 commented 1 year ago

I also set everything to "alpha" channel (all apps in Apps app and GrapheneOS update channel with absolutely no problems. Forget my first comment (outdated/not true anymore) 😀

robovoice1 commented 11 months ago

updated with detailed guide for nfc contactless payment with Android Stock and GrapheneOS: https://www.kuketz-blog.de/nfc-datenschutzfreundlich-bezahlen-mit-dem-android-phone/

and hardware based ChipTAN 😀