TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
ASN’s Android banking app reportedly blocks customers using GrapheneOS and other Android systems that do not meet its Google Play Integrity requirements. A developer cited in the report argues that Android’s hardware-backed key attestation could provide separate evidence about app identity and verified boot, but ASN’s technical rationale and policy details have not been confirmed in the supplied material.
ASN’s Android banking app is reported to block GrapheneOS and other Android systems that do not satisfy Google’s Play Integrity checks, restricting access to banking services for people using alternative operating systems. The report, published in a GitHub issue about banking-app compatibility, questions whether the check is necessary, but the supplied material does not include a statement from ASN confirming its policy or explaining its security requirements.
The issue concerns Google Play Integrity, a service apps can use to request a verdict about a device and its environment. According to the report, ASN’s app does not accept some Android installations that lack the expected Google-backed verdict, with GrapheneOS specifically named. The supplied source does not document which app versions or devices were tested, the exact error users see, or whether every GrapheneOS installation is affected.
The GitHub post also recounts a response from EPI, the operator of Wero, after someone asked about hardware key attestation. As quoted in the issue, EPI said that attestation “proves a key was generated in a TEE or StrongBox but not app or OS integrity,” giving that as a reason to use Play Integrity. TEE and StrongBox refer to hardware-backed security environments. The response is presented by the issue author; the supplied material does not include a direct link to the exchange or an independent confirmation of its full wording.
A developer contributing to the issue disputes that technical explanation. The developer says Android key-attestation certificates can include information about the device’s verified-boot state, whether the device is locked, the hardware security level, and the identity of the app that created the key. That account describes a possible alternative, but it is the developer’s technical argument—not evidence that ASN uses, supports, or has evaluated such a method.
Banking Access Depends on Device Checks
If the reported restriction is accurate, customers using privacy-focused Android systems may be unable to use ASN’s mobile banking app even when they own compatible hardware and can demonstrate that their device is secure. For users, the practical effect is a choice between relying on the bank’s supported software environment and finding another way to access banking services. The source does not say whether ASN offers a web option or another workaround for affected customers.
The dispute also highlights a wider design decision for financial apps: whether to rely on a third-party verdict such as Play Integrity, or to assess device and app properties through other mechanisms. A centrally issued verdict may be simpler for an app provider to implement and maintain. A more direct attestation approach can require the provider to validate certificates, manage trusted keys, and decide how to treat different operating systems. Those trade-offs affect both security policy and which customers can use an app.
The issue author argues that a bank’s reliance on Google’s check may exclude GrapheneOS for administrative convenience rather than because the alternative system is inherently insecure. That is an interpretation, not a confirmed explanation of ASN’s decision. Without ASN’s policy and threat model, readers cannot determine whether the restriction reflects a specific security concern, operational constraints, or a combination of factors.
Products Worth Considering
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
DJI Osmo Mobile 7P Smartphone Gimbal Stabilizer with Mic Mini Transmitter
Apple MacBook Air 15-inch with M5 chip, 16GB memory, 512GB SSD, and Liquid Retina display (Midnight)
As an affiliate, we earn on qualifying purchases.
The Dispute Over Android Attestation
Android offers multiple ways for developers to check characteristics of a device. Play Integrity returns a verdict through Google’s service, which app developers can use in deciding whether to allow a feature or transaction. The GitHub issue author describes it as relatively straightforward to integrate, while emphasizing that the decision about which devices qualify is made through Google’s system. The supplied material does not provide ASN’s implementation details or the exact verdict its app requires.
The developer who commented in the issue describes a different route using Android’s hardware key-attestation API. In that account, an attestation certificate can carry a challenge, information about whether a key was created in software or a hardware security environment, verified-boot details, and the app’s package and signing-certificate identity. The developer says GrapheneOS publishes verified-boot key hashes in signed data and documents how services can accept them. This is the developer’s account of the technical options, not an independent audit of ASN’s app.
The same developer also stresses the costs of that approach. A service would have to parse and validate the certificate data correctly and maintain its own trust rules. The developer recounts encountering validation errors while building a system, then says their own service still gates publishing on a Play Integrity verdict. The example illustrates that a technically available alternative does not mean an app provider has adopted it—or that replacing one check would be simple.
“Hardware key attestation “proves a key was generated in a TEE or StrongBox but not app or OS integrity.””
— EPI, as quoted in the GitHub issue
ASN’s Policy and Rationale Remain Unclear
The supplied material does not include a direct response from ASN, a public policy statement, or technical documentation describing the app’s integrity checks. It is not clear whether the restriction applies to all GrapheneOS users, which app versions are affected, or whether the block is triggered by the operating system, the absence of Google services, a particular integrity verdict, or another condition.
It is also unclear whether customers can complete essential banking tasks through a browser, telephone support, or another channel. The report does not establish that the app’s checks have caused a security failure, nor does it provide an independent security assessment comparing ASN’s chosen method with key attestation. The issue author’s criticism and EPI’s quoted explanation should therefore be treated as attributed arguments, not as a settled account of ASN’s reasoning.
A Response Could Clarify Compatibility
The main outstanding step is clarification from ASN: whether GrapheneOS and other non-Google Android systems are deliberately unsupported, what specific check the app uses, and what customers affected by the restriction can do. A statement from the bank could also distinguish a temporary compatibility problem from a standing security policy.
Until more information is available, users should check ASN’s official support channels before relying on a particular Android setup for account access. The GitHub discussion may add technical detail or user reports, but those reports alone cannot establish the bank’s full policy or the security rationale behind it.
Key Questions
Is ASN confirmed to block every GrapheneOS user?
No. The supplied source reports that ASN’s app blocks GrapheneOS, but does not identify the tested devices, app versions, or whether all GrapheneOS installations are affected. ASN has not provided a statement in the material supplied.
What is Google Play Integrity?
Play Integrity is a Google service that gives an app a verdict about a device or its environment. App providers may use that verdict when deciding whether to permit access or particular functions. The source does not specify ASN’s exact configuration.
Could hardware key attestation be used instead?
The developer cited in the GitHub issue says Android key attestation can provide information about hardware-backed keys, verified boot, device lock status, and app identity. Using it would require an app provider to validate certificates and maintain its own trust rules. The source does not show that ASN has adopted or tested this approach.
Why might a bank require a Google integrity check?
The issue author describes Play Integrity as easier to implement than a custom attestation validator. That may be one possible operational reason, but ASN’s actual rationale is not confirmed in the supplied material.
What can affected customers do?
The report does not confirm an official workaround. Customers can ask ASN whether browser banking or another support route is available and whether the restriction is temporary or a standing policy.
Source: github.com
