friendica (DFRN) - Link to source

On the 13th of august this year Česká spořitelna, a.s. have published an update to their #George banking app for #Android. that completelly disables #accessibility support when no white listed accessibility service is running on the device.

Thus #czech blind users who have updated their George app to the latest version can't run other accessibility services on their phones besides white listed apps such as TalkBack. I don't know which other apps are white listed yet.

I am afraid other Erste Bank subsidiaries or partner banks might do the same thing in the future. So this might potentially affect #austrian and #slovak blind people.

Here are the version numbers:

George Österreich 26.22.21 - appears to be accessible
George Slovensko 26.22.19 - Appears to be accessible
George Česká republika 26.26.21 - No longer accessible with 3rd party screen readers.

#Accessibility #android #czech #slovak #George #austrian

reshared this

in reply to Peter Vágner
glitchsoc - Link to source

Paweł Masarczyk

Plugging @Matschmuck , the Erste Bank's accessibility tester here in Austria. I believe the most realistic path forward would be the expansion of the white list which could be quite a challenge given the number of Talkback forks that appeared recently.
@Mathias Schmuckerschlag
in reply to Paweł Masarczyk
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag I'm afraid whitelisting screen reader package names is not a good idea unless they would like to expand it to verifying signing certificate fingerprints as well. Malicious actors can then just pretend to be one of the whitelisted app by reusing the same package name. This is really unfortunate.
@Paweł Masarczyk @Mathias Schmuckerschlag
in reply to Paweł Masarczyk
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag Why I think banks are doing all of this in the first place are not screen readers but apps that are trying to use accessibility features for malicious activities such as key loggers, overlays, automation apps doing fraud. Android it-self makes it complicated to enable such accessibility services. Adding another layer of protection just makes it more painfull for both users and screen reader developers. By introducing more fragmentation I think it may even weaken the security rather than improving it.
@Paweł Masarczyk @Mathias Schmuckerschlag
in reply to Peter Vágner
glitchsoc - Link to source

Paweł Masarczyk

@Matschmuck It's been a while since I used Android as my main driver but are the systems provided by Google secure enough? I mean, I know the security is tighter when submitting accessibility services into the Play Store but what about sideloading them from apk?
@Mathias Schmuckerschlag
in reply to Paweł Masarczyk
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag When side loading before the system allows you to enable the accessibility service you need to go to the settings app, then look for the app in question under applications, expand the more options under so called three dots menu and first allow secure settings from there. Afterwards system will allow you to enable the accessibility service. Also when side loading any app not just accessibility services you have to enable unknown app sources per application where you are installing from e.g. your web browser, your file manager and similar. So for non play store distributed apps you have to pass three layers of system security before the banking app protection has a chance to even do its job. If this trend will continue then we are likelly to get more layers of security and verification. Also next year google is tighting ability to side load apps even more difficult by waiting 24 hours in order to enable side loading at all.

My thinking is that if the accessibility service would not be so usefull people would rather choose not to pass all these extra hoops in order to get it installed and operational.

@Paweł Masarczyk @Mathias Schmuckerschlag
in reply to Peter Vágner
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag I have a very positive update on this matter. It turns out banks have reconsidered verifying accessibility service package names and now at least czech and slovak distribution of the #george apps are working fine with all screen readers and other accessibility services. I have no other details except of the fact it's working for me and a few other local users who have reported their success.

Thanks for reading and supporting this.

#George @Paweł Masarczyk @Mathias Schmuckerschlag
in reply to Peter Vágner
glitchsoc - Link to source

Paweł Masarczyk

@Matschmuck From my sources it seems that they have done quite an extensive research into what screen readers are used mostly so the white list still exists but it has been expanded to include Jieshuo, Talkforward, Corvus and a couple more things. If that still holds true this will make it difficult the more Talkback forks like #Backtalk and #Sandfly appear, possibly others in the future too. Other than this, genuinely useful apps utilizing accessibility service to function such as Wisprflow or Microsoft Authenticator trigger the black list too so one has to disable a bunch of useful things to get through. Is your experience different?
#backtalk #sandfly @Mathias Schmuckerschlag
in reply to Zvonimir Stanecic
friendica (DFRN) - Link to source

Peter Vágner

@Zvonimir Stanecic @Paweł Masarczyk I am using revolut too and it does not matter which screen reader I am running. Of course revolut has its own quirks but it can still be used.

There are for examples with initial setup that it randomizes numbers on its enter your pin screen when running other screen readers besides talkback, but this can be worked around by turning the screen reader and enable it again when that screen is already showing.

Or when revolut is setup to authenticate with finger print, all is working well.

@Paweł Masarczyk @Zvonimir Stanecic