Dutch 'idealist' bank ASN blocks non-Google Android, including GrapheneOS
- ID
- 43823
- Status
- summarized
- Published
- 06 Nov 2026, 5:27 PM
- Fetched
- 06 Nov 2026, 10:42 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://github.com/PrivSec-dev/banking-apps-compat-report/issues/105
- Source URL
- https://hnrss.org/best
Summary
- Score
- 5.0
- Created
- 06 Nov 2026, 10:43 PM
- Tags
- Audience
- developerssaas_startup_founders
What happened
Issue #105 in the PrivSec-dev/banking-apps-compat-report repo tracks the Dutch ASN Bank app (v2.40.2, Netherlands): filed July 2022, it first reported the app working fine on Pixel devices including a Pixel 6 Pro with no Google Play or Play Services installed, then a later comment reported that login fails without Google Play Services. The issue was closed as completed in August 2022, and the visible excerpt does not actually contain the recent evidence behind the 'blocks non-Google Android, including GrapheneOS' headline. The thread drew 326 points and 206 comments on Hacker News.
Why it matters
If you ship a fintech or banking app, this is the decision point: is Google Play Integrity a hard gate or one signal among several, and what fallback (SMS OTP, hardware key, device binding) do you offer users on de-Googled Android? The thread shows how murky that gets in practice — the same app was reported working without Play Services on a Pixel 6 Pro and then reported unable to log in without them, which is the kind of ambiguity that turns into a 206-comment support thread. Everyone else should treat this as a testing reminder: 'Android' is not one target, so your QA matrix needs at least one no-GMS device.
Discussion angle
For anyone building a payments or banking flow: if Play Integrity fails, do you block, degrade, or step up authentication — and what does that cost you in support tickets versus fraud loss?