Arch-TK

They seriously said something like this to you? The last time I had to interact with them to get a replacement hardware token was about 6 years ago.

So is it now their official policy that to have a bank account with them you must own a phone that can run their app?

I really don't get how your excuse worked, but I am guessing this is a made up policy and the fact it's a charity made them think twice about being assholes about this.

What's more convenient than a permanent irreversible requirement that if I ever want to do any banking, I must use my phone or go to a physical branch (which are slowly all disappearing) to recover access. I can never just go back to _not_ using the app, I can only move the app to another phone. And the app restricts which apps I can have installed and even which developer settings I can enable.

The average banking app is not about convenience, it is about restricting how a user can access their account, compliance box ticking and an endless march towards minimising liability at all cost. Meanwhile people are getting mugged and moving money at knifepoint because the device they normally carry around everywhere with them is now a gateway to their bank account.

I only run apps that are open source, or that I can audit and that don't abuse Android's silly features to restrict me, and only when the app isn't a requirement to access or interact with something. For example I refuse to buy any hardware which requires a proprietary app to use a feature.

The banking app _is_ the malware. It interferes with the normal use of your mobile device. For example, you can't use developer options to speed up the UI animation speed if you want to access your bank account. You can't install any app you want if you want to access your bank account. etc...

My fiancée who _does_ have the HSBC app has had to choose between enabling accelerated animations in the android developer settings and being able to access her bank account.

I think the HSBC app qualifies as malware but I'm morbidly curious how bad South Korea's version is...

In the UK, you _must_ have a bank account if you want to exist. I can't pay my mortgage in cash, and I can't take a salary in cash. So while I can _choose_ a bank, if there is no law literally preventing them from all requiring a smartphone to manage your money, then I imagine at some point that will happen, and then what do I do? Move to a different country?

It's not Pixel only for no reason, there aren't any other phones which meet the rather sensible requirements at this moment. And even the latest Pixel phones have regressed.

Thanks, but no thanks?

I use GrapheneOS, but if you as a bank want to gate access to my money via some kind of technology, you better be including it as part of the account.

For example, HSBC continues to let me manage my bank account via the web browser, and continues to offer a battery powered hardware token as the means of authentication.

I let you hold my money, for whatever reason. Why do you expect me to be your distributed infrastructure provider? I am not going to let you require that I run your proprietary malware in order to access my own money.

The idea where you are effectively _expected_ to constantly provide free compute for companies to run their complete garbage on hardware _you own_ just for the privilege of giving them money is one of the most absurd trend in recent times.

I'd say that JS webapps are the same but at least there you run things on your terms in a sandbox that you can inspect and look at the requests, and there's no effective enclave carved out of your hardware (except for EME but that's another topic for another day and I'd be complaining if banks started to use it too).

> Usually when a country goes after a foreign business they enforce it by imposing restrictions within their own borders and threatening the operators with legal action if they ever enter the country.

Yeah, unfortunately the UK isn't a country, it is actually a circus, so you can't apply any regular logic, you must apply circus logic.

The article is not critical of Flatpack, it is an endorsement of Flatpack.

I see, we are trying to re-establish ownership over the em-dash. This brings me joy.

This is specifically about good UX not about security, validation, or sanitisation.

License plates vary between countries but this description should be recognisable to most of the world.

It adds up...

I genuinely don't know if the people who keep doing this are just stupid, unreasonably contrarian, or intentionally trying to sound unreasonable (and are in favour of the UK style approach) to weaken the apparent position of being against the UK-style approach.

It's incredibly disappointing to see people constantly complain about the actually _reasonable_ implementations (that don't rely on a loss of privacy for adults _or_ children).

Still remember when people mostly referred to them as "quadcopters."