Is it possible to allow sideloading and keep users safe?

Is viciously impractical yet people on HN brag about doing it all the time?

5 years ago you could install custom rom and still use 99% of apps with it. Now with Google "safety" and "certification" features you won't be able to use most of financial apps and a lot of non financial apps too.

Obviously there no way on earth Google will allow you to decide whatever device you own is "safe". There is still ways to bypass it using kernel hacks, but it's both cat and mouse game and often not very trustworthy since a lot of software used to bypass safetynet is proprietary.

So yep, using custom OS on your phone is impractical because Google made it so.

And people keep saying this - what financial services companies are inaccessible via a web browser? And if they do exist, why do you choose such a bank?

I’ve heard people say Monzo in the UK. But there are plenty of banks in the UK you can choose from in the UK that have websites

> And people keep saying this - what financial services companies are inaccessible via a web browser?

You've already quoted one example so you know which was the trend is going, but since you asked here is another. New bank accounts handed our by https://boq.com.au/ can only be accessed from a phone, or via the web.

I started banking with them a long time ago. All accounts open back then have net banking, but no app. They've recently changed. New bank accounts can be accessed via an app, but web interface. I think this is a good thing in general. Insisting you do transactions using your phone or in a branch is far more secure that allowing payments via the web, or card.

As fraud continues to increase I suspect most payment systems will go that way. I would not be surprised if the bulk of non-cash payments on the planet are already done by phone: https://theconversation.com/no-more-card-charges-how-austral...

Then choose another bank f not using apps is imprtant to you. I mean you have agency. Are you saying there are no banks in Australia that you can do without an app?

N26 bank for example.

It's actually an EU law that financial apps must use something like Play Integrity and online banking must be authenticated by a smartphone.

Then you should be directing your ire at your legislators. For forcing dependence on Google and Apple.

I was answering this question from you, not asking for advice:

> what financial services companies are inaccessible via a web browser?

Yes the fix is obvious if it was a problem. I thought I made it clear I think it is a net increase in security, and so isn't a problem, for me anyway. Even if it was a problem, your throw away suggestion of "just move to another bank" is not so easy if you've borrowed money from the bank.

None of this has anything to do with topic being discussed - which is should Google allow side loading of unsigned apps. You seem to be positively enthusiastic about handing the keys to your life and assets to Google and / or Apple. The comments you see here are from people who aren't so sanguine about it. You look to be dismissive of their concerns. I would be too, if I thought if what they are doing yielded a big increase in security.

The OS should be so secure loading any app, signed or not, malicious or not, is mostly harmless. That is true for iOS and Android. You can always uninstall an app, and you have to give it additional permissions to access your data. I don't know if an app can attest it was downloaded from the web store so organisations like banks can be sure they are talking so software they issued. If it isn't, that's a security hole that should be closed.

Unlike adding attestation, sideloading apps doesn't look to be a security hole that needs fixing to me. I'm doubt it provides much additional security. I've personally had to fix phones whose apps went rogue after a spammers bought the developer licence from an abandoned app. Worse, the app still had the permissions granted to the original.

This new requirement does create barriers. I use apps from F-Droid. They typically have no ads, and they do what they say on the box. Security in the long term is higher than a Google store app because the source is available, and F-Droid uses reproducible builds. But I would not be surprised to find some open source app developers that aren't as keen as you are to hand over their private data to Google in order to get their keys signed, so there will be less F-Droid apps. If that happens, this new requirement would lead to a net reduction in security for me.