TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
ASN’s banking app is reported to block Android systems that do not pass Google’s Play Integrity checks, including GrapheneOS. A developer’s account in a linked GitHub issue argues hardware-backed Android key attestation could check device and app integrity by another route, but the supplied material does not include a statement from ASN confirming its policy or explaining its rationale.
ASN’s banking app reportedly blocks non-Google Android systems, including the privacy-focused GrapheneOS operating system, according to a report discussed in a GitHub issue about banking-app compatibility. The supplied material attributes the restriction to use of Google Play Integrity, but does not include a direct statement from ASN confirming the policy or setting out its reasons.
The GitHub issue centers on whether a bank or payment service must use Google’s Play Integrity service to assess an Android device, or could instead rely on hardware-backed key attestation. A developer contributing to the discussion says the two approaches offer different ways to evaluate a device and the app requesting access. The report says ASN’s app rejects systems outside Google’s expected Android environment, with GrapheneOS among the affected systems.
The developer argues that Android’s Key Attestation API can provide a certificate containing a server-provided challenge, the key’s security level, information about verified boot and whether the device is locked, and the package name and signing-certificate digest of the app that generated the key. In the developer’s account, these fields can help a service check operating-system integrity and app identity. The developer says GrapheneOS publishes signed information about its verified boot keys that a service could use in an allowlist.
The contributor also describes the trade-off: verifying key-attestation certificates requires a service to parse certificate data and maintain its own trust rules. Play Integrity is described as a simpler check that returns a verdict from Google. The developer says the app they work on uses both methods and still gates a feature on a Play Integrity result, meaning it would also block GrapheneOS in its current configuration. That is the contributor’s own implementation, not evidence of ASN’s internal design.
Access Depends on Google Checks
If the report accurately describes ASN’s app behavior, customers using GrapheneOS or other non-Google Android builds may be unable to use the bank’s mobile service on their chosen device, even if the device has hardware security features. That makes a technical choice about fraud and device checks a practical access issue for customers, rather than simply a difference in operating-system preference.
The discussion also highlights a broader trade-off for financial services. A bank can rely on a centrally operated integrity verdict, which may be easier to integrate and justify, or build and maintain its own checks using hardware-backed attestations. The developer says the latter requires specialist implementation and ongoing maintenance. The supplied material does not establish which security risks ASN is addressing, or whether the bank has considered alternative verification methods.
Popular right now
Bose QuietComfort Ultra Earbuds (2nd Gen) – Wireless Noise‑Cancelling Earbuds with Mic, Immersive Audio, USB‑C Charging, Up to 6 Hours Batte
Dyson V15 Detect Cordless Vacuum
Dyson Cyclone V10 Origin Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
Two Android Integrity Approaches
Google’s Play Integrity service returns a verdict that an app developer can use when deciding whether to permit access to an app or feature. The GitHub contributor characterizes it as comparatively simple to integrate, while emphasizing that the decision about which devices qualify is made through Google’s service. The report does not provide ASN’s configuration or the specific verdict its app requires.
Android key attestation is a separate mechanism described in the issue. It uses a hardware-backed certificate to report details about a key and the device environment. The developer says a service can validate the certificate chain against trusted roots and inspect the attestation data, but must take responsibility for interpreting it and deciding which boot keys to accept. The contributor says this alternative is technically feasible, not that it is effortless or automatically equivalent to every Play Integrity check.
The issue also includes a reported response from EPI, the operator of Wero, which said hardware key attestation shows that a key was generated in a trusted execution environment or StrongBox but not app or operating-system integrity. The developer disputes that explanation, pointing to the additional fields in Android’s attestation certificate. This exchange concerns EPI’s stated rationale, not a confirmed explanation from ASN.
““That is OS integrity (verified boot, locked bootloader) and app identity, signed by the chip, chained to Google’s published roots.””
— Developer contributing to the GitHub issue
ASN’s Policy and Rationale
The supplied report does not include a response from ASN, a direct test log, or documentation specifying which Android versions and device configurations its app rejects. It is therefore unclear whether the block applies to all non-Google Android systems, how the app communicates the restriction, or whether ASN offers another way to access mobile banking.
The material also does not establish that ASN uses a particular Play Integrity verdict, whether its checks have changed, or whether the bank would accept a hardware-attestation approach. The technical claims about Android certificate fields and GrapheneOS’s published boot-key information come from the GitHub contributor’s account; the supplied material does not include independent testing of ASN’s app or a formal assessment of the competing methods.
Confirmation From ASN Needed
The immediate next step is confirmation from ASN about the reported restriction, its scope and the security rationale behind it. A direct explanation would clarify whether Play Integrity is required, which devices are affected, and whether users have an alternative route to banking services.
Until the bank or another documented source provides those details, the GitHub issue establishes a technical dispute and a reported compatibility problem, but not ASN’s full policy or decision process. Customers affected by the restriction may need to contact the bank for current guidance on supported devices and access options.
Key Questions
What is ASN reportedly doing?
The report says ASN’s banking app blocks non-Google Android systems, including GrapheneOS. The supplied material does not include an official statement from ASN confirming the restriction.
Why might GrapheneOS be rejected?
The report links the issue to the app’s reliance on Google Play Integrity. It does not provide ASN’s precise configuration or say which integrity verdict is required.
Could Android key attestation be used instead?
A developer in the GitHub issue says key attestation can provide information about verified boot, device lock state and app identity. Using it would require a service to validate certificates and maintain its own trust rules; the supplied report does not show that ASN uses or accepts this method.
Has ASN explained why it blocks these devices?
No explanation from ASN appears in the supplied material. The technical rationale discussed in the issue includes a reported statement from EPI, which is a separate organization and not ASN.
What should affected customers do?
Customers unable to use the app should ask ASN which devices it currently supports and whether it provides another way to access mobile banking. The report does not identify a confirmed workaround.
Source: github.com
