HSBC decides Samsung Secure Folder and Android's Private Space are no place for a banking app HSBC has blocked its Android app from running inside Samsung Secure Folder and Android Private Space without warning, leaving some customers unable to access online banking. The Register asked HSBC to explain the change. It said the block was "a proportionate security control designed to mitigate a foreseeable security risk. It …
Truth is, malware can attack, read, corrupt, or lock other apps that live inside that specific Secure Folder because they share the same isolated container environment. I guess the devs are worried they can't scan which apps arebeing installed inside the folder... where they can notice stuff like bitwarden being installed in the regular part of the phone because banking apps are granted a special exception under Google 's dev guidelines
It's more likely that secure launch restrictions designed to keep said privately stored apps launching non-private webviews (and other stuff that'd defeat the point of the protection) interfered with functionality like easy transfers and certain types of fraud protection involving web-based transactions. These features are also incompatible with Android user profile switching, which is a better way to secure financial apps anyway.
I wonder if the decision wasn't more down to potential exploits in their software.
I don't use either web or phone banking – the risk of credentials being compromised remains high whichever way you do it. All my stuff runs through a dedicated app that uses an external card reader to encrypt transactions.
As well as having to move the app out of Android Private Space or Samsung Secure folder so other apps (malware) can find it, will probably not let you use any keyboard other than Gboard and Samsung (which upload data by default), and won't run if you have any app which was not installed by the Play Store, like e.g. F-Droid or e.g. Bitwarden installed by F-Droid. It all makes you want an offline card reader.
They often remind me of the time a fair while ago when HSBC were touting voice passwords and telephone banking. I had to politely explain to the operator that I was not charmed with the idea as it was already possible, but hard to fake. A few months later they pulled the feature silently.
Recently was asked to give my DOB to prove my identity... "But you don't have my DOB!" (was the correct answer)
Years ago I was prompted to answer a security questions I'd given when first signing up for Abbey Nat. Unfortunately I would never had answered any of the options given because the questions all lead to ambiguous answers meaning I would have to have remembered which of the possible answers I had given at the time
HSBC seems to define secure as "a device we can sufficiently inspect". If they're going to decide which apps and configurations are safe enough to permit banking, then who is responsible when an approved configuration is subsequently compromised? Presumably allowing the app to run isn't HSBC warranting that the device is secure, so the customer gets the worst of both worlds: HSBC decides what they're allowed to run in the name of security, while accepting no corresponding guarantee that what they permit is actually secure.
>” HSBC decides what they're allowed to run in the name of security”
This - bank deciding what you can have installed and/or running - has been the case for some years.
Barclays for example is very strict on which Remote Desktop/support tools are installed on a Windows PC. I had problems logging into my account via the web site, getting an error code. Talking to Barclays they told me the error code meant I had AnyDesk installed, a tool often used by scammers, hence if they detect it they prevent the login with an error code. I uninstalled AnyDesk and regained account access.
We can argue about whether Barclays were or were not right with respect to AnyDesk, but the case illustrate just how much information your browser makes available to the websites we visit and thus can be used against you.
Perhaps Netscape era was too early, but by 2010-ish every mainstream browser stopped access apart from IE.
Aka a device we can data-rape.
Apps and websites are controlled by the marketing people. Sure, the bean-counters at HSBC may want to make everything paperless, to save in printing costs, but the details of what the apps and sites will do are down to marketing. Devs and cybersecurity guys are told what to add in, what to leave out, but the really important thing is what can be done to drive the sales.
And banks have you by the short and curlies. Yeah, you can change banks, you can stop using the app, but that'll impact you more than just deciding to switch supermarket.
They may not be downloading your contacts but knowing all the apps you have installed, precious precious customer profiling.
Having been a HSBC customer in the past, left due to the ever decreasing incompetent customer service and overdraft costs.
I remember keeping the physical keypad for the exact reason as the app has to be one of the flakest I have ever used with it authenticating then failing, they seem like they have a dev team that only likes to support Apple, Google, OnePlus and Samsung. Anything outside of that like Honor or Oppo and you start getting it messing you about. Moved to Nationwide and much better service and app and notifications and none of this pick and choose what is secure bs.
I suspect its because someone could claim if they could scammed or didn't receive an alert that their is a potential loophole and they would have to pay out is the real reason and maybe UK Government with the need to access and monitor accounts of some receiving benefits etc, but I bet its the potential risk of paying out.
Ironic how they go on about security, but have been well known for having massive fines for money laundering, so they don't like secure environments, but happy to show a blind eye to dodgy money, says it all why you shouldn't bank with them lol.
> What happened to the customer is always king ?
When was that ever true?
Yes, you see TikToks and YTs of weirdos complaining that they deserve something because "the customer is always right" but they are just nuts.
Customer and supplier are in a simple contractual relationship, as set out by law. Which includes how & when either side can just walk away. It behooves both sides to be civil. That's it.
"The Customer is King" was only ever a sales rhetoric in order to tell salesweasels how best to interact with customers, NOT that they were "always right" or that you had to acquiesce to every demand - it was merely that you treated them well, were honest, tried to see things from their perspective, gave them good advice etc, all whilst making sure they spent oodles of cash in your establishment, and trying to get them back in the future to spend oodles more.
Anon for reasons that will become obvious.
A family friend was head-hunted for a very senior role in their anti-laundering department. They left after about 6 months when it became obvious that actually detecting money laundering wasn't what the department was about.
Nationwide now demand you give them a face scan to send money in the app, doesn't disclose its handled by an American provider either
The past five to ten years has seen what was a building society vanish. Replaced by gimmick obsessed bank in all but name, with a board being paid eye watering sums and institutionally hostile to a member nominated finance versed director candidate, why? I'll let you draw your own conclusions on that one....
So it takes 5-10 days to get a physical security token thing, or you can switch accounts in 7 days using the Current Account Switch Service https://www.currentaccountswitch.co.uk/about-the-service/ Given that HSBC are effectively telling me what apps I can have on my phone where they are installed and where I installed them from. Even ignoring any other, potentially less favourable, reasons they have for doing this, I would switch accounts and let them know this is the reason.
While it can be a bit of a p.i.t.a. at times, I only use the hardware code generator - despite them pushing me frequently to install an app. There are too many ways an app on a phone can stop working - lost phone, run out of power, corrupted, ...
Now add another reason - the bank can unilaterally and without warning change their definition of "safe enough" and lock you out of your account(s). There are times, particularly around end of month and pay day when not having access would be problematic and result in missed payments, overdraft charges, etc. - I bet they'd disavow any responsibility for refunding these and sorting out the damage to your credit rating.
Not with HSBC, it's not a reader for a card, it's small device - credit card size, but about 3-4 cards thick - with a keypad and display. You put in a PIN, it gives you a code to use for login. I assume behind the scenes it's some form of time based OTP generator.
And there's no way to replace the battery - when it dies, they send you a new one, but they do last many years.
This post has been deleted by its author
What a revolution.
Personally, I've never understood the people who think that having their banking details on an item that can be stolen, dropped into the toilet or otherwise lost, is a good idea.
If someone steals my VISA, I am one call away from having it blocked, because I have the number on my phone.
If my phone is stolen, they won't get my banking details because that is on my VISA, which they did not take.
If, by any chance they manage to steal both, they still won't get farther than a few small purchases which I will be able to block as soon as I get back home.
Separate your risks, people.
If they steal my phone they can't get at my banking details. You think they are stealing an unlocked phone with an unprotected app connected to a bank that will immediately allow them to transfer money out to a third party account? Yeah right, none of those things are true!
"If someone steals my VISA, I am one call away from having it blocked, because I have the number on my phone."
And yet you can buy phone cases which provide slots to tuck your card into so card and phone can be conveniently stolen together.
Amazingly, some people use this facility.
I don't carry a card or cash most of the time when I'm out and about, because there's not really a need. If I'm going somewhere or might go somewhere where I don't know what payment options are available I'll take a card with me, but I imagine pretty soon I'll be able to just assume everywhere can do Apple Pay / tap to pay. I keep a prepaid (i.e. low limit so I don't care if it is lost or stolen) debit card along with a few bucks in quarters in my car for parking since you never know what you can get but I just noticed yesterday the lot nearest my gym got upgraded so the main reason I have that disposable debit card in my car is now gone.
The only time I bother to carry my wallet with cards and cash like the old days is if I'm going say an hour away from home or more.
When we asked HSBC about how it planned to notify customers, an UK spokesperson told us: "Customers who try to access our app with private space and virtual space tools are informed that to help protect their accounts, they will not be able to access the HSBC UK mobile banking app within private space and virtual space tools."
Basically, you'll find out when you open the app!! Not good enough, HSBC!!! Esp if you're locked out!
I hate mobile banking apps.
This is another reason why when I loose the ability to opt to use a secure key device and am forced to use a mobile app for authentication and online banking I'll be looking for another bank or may I just need to start demanding payment in gold sovereigns.
Unfortunately I think it is only likely to get worse (even more locked down).
I am in Thailand and most of the big banks have removed any web access and allow only app access to your money (other than a branch visit....)
They also don't allow any vpn or certain other classes of app to be running when you want to use the app. I gave up trying to use a rooted phone and now have a separate phone only for banking and still have to do a face scan if I want to transfer more than a grand equivalent - and the facial scan appears temperamental and this is common with many posters on a local forum.
Unfortunately if you want the convenience of paying bills from home there isn't any choice......
I've worked several places where engineering would make a change and push it out, without telling the rest of the organisation either before or during. Support then gets calls... and has no idea. So CS agents can't help, website isn't updated, sales reps don't know, help sections aren't updated... etc.
Software release management is not just about the software.
This is a perfect example, and someone in product management and/or programme management needs to be better, or have more authority.
