TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A GitHub report says ASN’s banking app blocks Android devices that do not use Google’s Play Integrity checks, including GrapheneOS. The supplied material does not include a response from ASN, the app’s technical documentation, or confirmation of the full range of affected devices.
Dutch bank ASN’s Android banking app reportedly blocks phones running GrapheneOS and other Android systems without Google services, according to a GitHub report about banking-app compatibility. The report links the restriction to the app’s use of Google’s Play Integrity service, but the supplied material does not include a statement from ASN confirming the policy or explaining which devices are affected.
The report says an exchange in the linked GitHub issue with EPI, the operator of Wero, described hardware key attestation as evidence that a key was created in a trusted execution environment (TEE) or StrongBox, but not proof of app or operating-system integrity. The report’s author disputes that description, arguing that Android’s key attestation data can include information about verified boot and the app that generated the key.
According to the author, an Android attestation certificate can include a supplied challenge, the key’s security level, a Root of Trust record and the application’s package name and signing-certificate digest. The author says these data can help a service check whether a device has verified boot enabled and a locked bootloader, and identify the app associated with the key. GrapheneOS, the author adds, publishes verified-boot key hashes that a service could use in its checks.
The author says Play Integrity is simpler for developers because it returns a Google-issued verdict, while a custom attestation system requires certificate parsing and management of trusted keys. In the author’s own small-app testing, a validator initially misread some certificates before being corrected. Those details describe the author’s experience, not ASN’s implementation: the material does not establish which checks ASN performs or whether it considered alternative attestation methods.
Access for Privacy-Focused Android Users
If the reported restriction is accurate, customers using GrapheneOS or Android without Google’s services may be unable to use ASN’s mobile banking app, even if they can access their accounts through another route. That could make a choice of operating system a practical barrier to routine banking tasks, rather than simply a matter of device preference.
The dispute also highlights a trade-off for financial services. A Google-provided integrity verdict can be easier to integrate and audit, while relying on it may exclude devices that do not meet Google’s criteria. A service that checks hardware attestation directly may have more control over what it accepts, but must build and maintain that process. The report argues that the latter approach can provide useful security signals; it does not show that ASN’s policy is insecure or that a different method would meet the bank’s requirements.
Products Worth Considering
DJI Osmo Mobile 7P Smartphone Gimbal Stabilizer with Mic Mini Transmitter
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
Bose SoundLink Plus Portable Bluetooth Speaker, Black
As an affiliate, we earn on qualifying purchases.
Two Ways to Check Device Integrity
Android apps can use Play Integrity to request a verdict from Google about a device or app. As described in the report, a developer can use the returned result as part of a server-side access decision. The report says that this method leaves Google to determine whether a device qualifies for a particular integrity category, without explaining the basis for a verdict in the token.
Android’s hardware-backed key attestation is a separate mechanism. The report’s author says it can provide signed certificate data about a key, the device’s verified-boot state and the app identity associated with the key. A service choosing this route would have to validate the certificate chain and decide which device keys and states it trusts. The report says GrapheneOS documents its verified-boot key hashes; whether ASN has assessed or accepted them is not established.
The supplied source also describes the author’s own app as using both methods, with publishing still gated by Play Integrity. The author says this was due to the convenience and auditability of the Google check, not a finding that the alternative attestation data offered no security value. This account is an individual developer’s experience and should not be taken as evidence of ASN’s internal reasoning.
“Hardware key attestation “proves a key was generated in a TEE or StrongBox but not app or OS integrity.””
— EPI, as quoted in the GitHub report
ASN’s Policy and Device Scope
The supplied material does not include ASN’s response, a direct confirmation from the bank that GrapheneOS is blocked, or details of a test establishing the app’s behavior across devices. It also does not identify the app version, the date the restriction began, or whether customers are blocked from signing in, completing particular transactions or using only some app features.
It remains unclear whether the reported behavior affects every Android system without Google services, whether there are exceptions, and what alternative banking access ASN offers to affected customers. The technical argument about hardware attestation is the report author’s account; the material does not independently verify ASN’s checks or show that the bank could replace its current approach without changing its security and compliance processes.
Awaiting a Response From ASN
The next key development would be a statement from ASN confirming whether its app rejects GrapheneOS or other non-Google Android systems and explaining the basis for that decision. Details on affected app versions, supported devices and available alternatives would help establish the practical effect for customers.
Further technical documentation or reproducible testing could clarify whether the app specifically requires Play Integrity, whether another check is also involved, and what happens when a device does not return an accepted verdict. Until that information is available, the reported restriction and its rationale should be treated as unconfirmed by the bank.
Key Questions
Does ASN’s banking app block GrapheneOS?
A GitHub report says it does, but the supplied material contains no direct confirmation from ASN or a detailed account of testing across app versions and devices.
Why might an Android banking app reject a device?
The report links the behavior to Google Play Integrity, a service that provides apps with device or app integrity verdicts. It does not establish ASN’s specific reason for adopting the check.
Can hardware key attestation check operating-system integrity?
The report’s author says Android attestation certificates can include verified-boot and app-identity data. The author also notes that developers must validate certificates and maintain their own trust rules.
Has ASN explained the restriction?
No response from ASN is included in the supplied material. The bank’s policy, technical rationale and any exceptions remain unclear.
Source: github.com
