friendica (DFRN) - Link to source

On the 13th of august this year Česká spořitelna, a.s. have published an update to their #George banking app for #Android. that completelly disables #accessibility support when no white listed accessibility service is running on the device.

Thus #czech blind users who have updated their George app to the latest version can't run other accessibility services on their phones besides white listed apps such as TalkBack. I don't know which other apps are white listed yet.

I am afraid other Erste Bank subsidiaries or partner banks might do the same thing in the future. So this might potentially affect #austrian and #slovak blind people.

Here are the version numbers:

George Österreich 26.22.21 - appears to be accessible
George Slovensko 26.22.19 - Appears to be accessible
George Česká republika 26.26.21 - No longer accessible with 3rd party screen readers.

#Accessibility #android #czech #slovak #George #austrian

reshared this

in reply to Peter Vágner
glitchsoc - Link to source

Paweł Masarczyk

Plugging @Matschmuck , the Erste Bank's accessibility tester here in Austria. I believe the most realistic path forward would be the expansion of the white list which could be quite a challenge given the number of Talkback forks that appeared recently.
@Mathias Schmuckerschlag
in reply to Paweł Masarczyk
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag I'm afraid whitelisting screen reader package names is not a good idea unless they would like to expand it to verifying signing certificate fingerprints as well. Malicious actors can then just pretend to be one of the whitelisted app by reusing the same package name. This is really unfortunate.
@Paweł Masarczyk @Mathias Schmuckerschlag
in reply to Paweł Masarczyk
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag Why I think banks are doing all of this in the first place are not screen readers but apps that are trying to use accessibility features for malicious activities such as key loggers, overlays, automation apps doing fraud. Android it-self makes it complicated to enable such accessibility services. Adding another layer of protection just makes it more painfull for both users and screen reader developers. By introducing more fragmentation I think it may even weaken the security rather than improving it.
@Paweł Masarczyk @Mathias Schmuckerschlag
in reply to Peter Vágner
glitchsoc - Link to source

Paweł Masarczyk

@Matschmuck It's been a while since I used Android as my main driver but are the systems provided by Google secure enough? I mean, I know the security is tighter when submitting accessibility services into the Play Store but what about sideloading them from apk?
@Mathias Schmuckerschlag
in reply to Paweł Masarczyk
friendica (DFRN) - Link to source

Peter Vágner

@Paweł Masarczyk @Mathias Schmuckerschlag When side loading before the system allows you to enable the accessibility service you need to go to the settings app, then look for the app in question under applications, expand the more options under so called three dots menu and first allow secure settings from there. Afterwards system will allow you to enable the accessibility service. Also when side loading any app not just accessibility services you have to enable unknown app sources per application where you are installing from e.g. your web browser, your file manager and similar. So for non play store distributed apps you have to pass three layers of system security before the banking app protection has a chance to even do its job. If this trend will continue then we are likelly to get more layers of security and verification. Also next year google is tighting ability to side load apps even more difficult by waiting 24 hours in order to enable side loading at all.

My thinking is that if the accessibility service would not be so usefull people would rather choose not to pass all these extra hoops in order to get it installed and operational.

@Paweł Masarczyk @Mathias Schmuckerschlag