TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
A report in a GitHub issue says ASN’s banking app blocks Android devices running non-Google operating systems, including GrapheneOS. The material provided does not include a statement from ASN confirming the block or explaining its policy; a separate developer argues that hardware-backed Android key attestation could provide relevant integrity signals, though it requires more work to validate.
ASN’s Android banking app is reported to block non-Google Android operating systems, including GrapheneOS, raising questions about how the Dutch bank checks device security and whether users can access banking services on privacy-focused software. The source material is a GitHub issue discussion, not a statement from ASN, and does not establish the bank’s official rationale or how widely the restriction applies.
The report concerns Android devices that do not use Google’s standard software environment. GrapheneOS, an Android-based operating system, is among the systems the report says ASN’s app blocks. The provided material does not document the exact error message, affected app version, device models, or whether access is denied at login, during setup, or while using a particular feature.
The discussion also refers to a response from EPI, the operator of the Wero payment service. According to the GitHub post, EPI said hardware key attestation can show that a key was generated in a trusted execution environment (TEE) or StrongBox, but does not establish app or operating-system integrity. The post’s author disputes that description, saying Android key-attestation certificates can contain verified-boot information and the identity of the app that generated the key.
That technical explanation comes from a developer contributing to the discussion, not from ASN or an independent assessment of ASN’s implementation. The developer says a service can check attestation certificates against trusted roots and evaluate operating-system boot state, but that requires parsing certificate data and maintaining trusted-key information. The post does not show that ASN uses this approach or that it would accept GrapheneOS if it did.
Access Depends on Android Security Checks
If the reported restriction applies broadly, customers using non-Google Android systems may be unable to use ASN’s mobile banking app, even when their devices have security features such as verified boot. That could affect people who choose alternative operating systems for privacy or control over their software. The available source does not establish whether customers have another supported way to bank or whether the restriction affects all app functions.
The technical debate matters because a security check can be both a protective measure and a compatibility gate. Google’s Play Integrity service returns verdicts that an app provider can use to decide whether to allow access. The GitHub contributor says an alternative based on hardware key attestation could provide evidence about boot state and app identity, but would require the service provider to interpret and maintain those checks. Which signals a bank accepts is a policy and implementation decision; the discussion does not prove that either method is sufficient on its own for ASN’s security needs.
Products Worth Considering
Garmin Forerunner 165 GPS Running Smartwatch, 43 mm, Whitestone
Philips Sonicare 5950 Rechargeable Electric Toothbrush with 2 Brush Heads, Pink
Blueair Blue Pure 511i Max Smart Air Purifier
As an affiliate, we earn on qualifying purchases.
Two Ways to Check Android Devices
Android offers hardware-backed key attestation, which can include information about the security level protecting a key and verified-boot state. The developer who posted in the issue says the certificate also identifies the app that created the key. They argue that GrapheneOS publishes verified-boot key hashes that a service could use in an allowlist. These are the contributor’s account of the Android attestation system and GrapheneOS documentation; the material supplied does not include a direct technical review of those claims.
The alternative discussed is Google Play Integrity, a service that provides an app with a device-integrity verdict. The developer describes it as easier to integrate because the app can request a verdict from Google, while saying the service provider has less direct visibility into the basis for that result. Their post also reports results from 64 beta-tester verdicts, in which they say they did not receive a “MEETS_STRONG_INTEGRITY” result. That is a small, self-reported sample, not a measure of ASN customers or Android devices generally.
“Hardware key attestation “proves a key was generated in a TEE or StrongBox but not app or OS integrity.””
— EPI, as quoted in the GitHub issue
ASN’s Policy and Scope Remain Unconfirmed
ASN has not provided a statement in the source material, so its reason for blocking non-Google Android systems is unknown. The report does not establish whether the restriction is intentional, tied to a particular security check, temporary, or limited to certain app versions or devices. It also does not show whether ASN has tested GrapheneOS specifically.
The technical dispute is not settled by the supplied material. The GitHub author describes capabilities of hardware key attestation and argues that they could address integrity checks, but there is no independent validation of ASN’s security requirements or of a proposed implementation. It remains unclear whether the app uses Play Integrity, another check, or a combination, and whether changing its approach would allow GrapheneOS while meeting the bank’s requirements.
Customers Need an ASN Response
The next useful development would be a statement from ASN specifying which Android devices and app versions are affected, what users see when access is blocked, and whether the bank offers another supported route to mobile banking. Confirmation from ASN would also clarify whether the restriction results from Google Play Integrity or a different compatibility or security rule.
Until that information is available, users should treat the reported block as an account from the GitHub discussion rather than a fully documented bank policy. The source material gives no timeline for a fix, policy change, or further investigation.
Key Questions
Is ASN confirmed to block GrapheneOS?
A GitHub report says ASN’s Android banking app blocks GrapheneOS and other non-Google Android systems. The supplied material does not include confirmation or comment from ASN.
Why might a banking app reject a non-Google Android system?
The source discusses device-integrity checks, including Google Play Integrity. It does not establish which check ASN uses or give the bank’s reason for the reported restriction.
Can hardware key attestation provide information about Android integrity?
The developer in the GitHub discussion says Android key-attestation certificates can include verified-boot information and app identity. EPI’s position, as quoted in the discussion, is that attestation shows where a key was generated but not app or operating-system integrity. The provided material does not include an independent technical assessment resolving the disagreement.
Does the report say ASN will change its app?
No. The source material gives no announcement, fix timeline, or commitment from ASN.
Source: github.com
