Banking apps on Sailfish OS

Figured that disabling Ptrace Scope allows me now to start OP-mobiili (change value of /proc/sys/kernel/yama/ptrace_scope from “1” to “0”).
I have a second C2 which has not been fastboot flashed, and uses the latest OS version and has the value set to “1” where OP-mobiili works…
On my AX2, which has been upgraded to latest 5 version, Ptrace Scope does not exist … and still no issue with the App.
While disabling this settings on my C2 helps me, I’m not certain I should keep it as it is now, for security reasons (?)…but wonder if something else has changed, making it “screaming” in journalctl about OP-mobiili trying to attach to another instance of itself using ptrace() ?
As I’ve already opened a ticket to the Support, I will update them with this :crossed_fingers:

5 Likes

We have a Jolla-internal bug about the same problem, reported by one of our engineers.

6 Likes

Is this only on C2 or also the Sony’s? (especially X10?)

Only OP 70.0.0 works on SFOS devices i.e. Xperia 10III and C2 with 5.0.0.62 which I tested. I complained to OP that their latest Android version doesn’t work. Let’s hope they keep v70 active for a while.

2 Likes

Thanks :pray: someone is looking into this!

OP 70.0.0 (I’m fairly sure that was the version I was using) just stopped working for me today. =/ Hope that a solution can be found.

Same here. I also hope we get a solution soon, as this is quite must to have app

1 Like

Hi, for the record I have Norwegian bankid running without anything special and vipps running on my Xperia 10 IV with MicroG.
I just selected all the options in microG and Vipps runs. The DNB app doesn’t work but I can open the webpage without a problem
Luke

At least they are consistent now as version 70.0.0 stopped working today :frowning:

Looking at the comments on Play Store, OP is copypasting the same mantra about cybercrime even to owners of legit Android phones. That’s so bad I don’t know if I even wanna get a cheap Android backup phone, if there’s a risk to it.

Do you think this is a solvable problem or have they invented something that cannot be spoofed?

PS. What a load of dog shit that the ID mechanism is in the same app. If it were not, we could ignore the big app and use a browser instead. Probably way more resilient against cybercrime than whatever the hell this is. Hope I have my paper logins somewhere…

So, I can confirm that OP-mobiili version 72 works on my XA2 after updating from 71.0.1 (install code 7104) as I had the same issue as others with a “too old” App version.
I also installed that same version (72) on my C2 from scratch.
To get it working on the C2, I have to change the Ptrace Scope value to “0” as mentioned previously (but that, I do not believe it should be advised…but hey, it works for me).
On my XA2, there is no such Ptrace Scope file, so nothing to modify there (does it make my XA2 less secure? Donno…).

4 Likes

Slovakia

  • Erste Bank (Slovakia) - Slovenská sporiteľňa
    • George Slovensko
      • 25.02.26 (2502262) G4 Andreasisko 20250326 MicroG 0.3.6.244735 XA2, 10III (“App download not trustworthy”, and app requires an activated Android lock PIN, which AppSupport doesn’t support)

This is some very serious PII in this topic, users and what bank they use, just for all your consideration if that should be available to all the webcrawlers.

1 Like

TBF I don’t think anyone discerned between personal and business customerships.

It’s also not an uncommon default that people have accounts in multiple banks, so you could just spear-phish your victim at every bank until you get lucky.

Way more important that the apps work.

1 Like

If you don’t want cybercrime don’t use a mobile phone for accessing important services, mobile phones/OS from all manufacturers (including SFOS) are far worse security targets than up-to-date computers, if they are up-to-date at all.

1 Like

… which translates to: If you live in Portugal, move to another country…
:wink:

1 Like

Hard disagree, phones are just far more insecure than computers in a large part due to the hardware vendors using binary blobs that only work with specific kernels and other drivers in the stack and just like that even though you are using SFOS 5 which was released not too long ago (or Android X/iOS X) you still have a ton of insecure/unpatched software running on your device and often insufficient sandboxing between apps increasing the chance that your phone will be your compromise vector.

Of course computers when maintained badly can be just as bad or worse but all in all if you keep your computer up to date and don’t do dumb things it seems to me that it would be worlds more secure than your average phone.

Thus if you have a choice you should not bank on your phone.

And with that I will stop taking this topic any further OT.

1 Like

That helps also on Xperia 10 III.

3 Likes

This setting does not survive restarts. To make it persistent, I created a drop-in sysctl file /etc/sysctl.d/91-opmobiili.conf to contain the setting over restarts.

It looks like the op-mobiili devs forgot to remove debugging before publishing the app. If the QC is that sloppy, I wonder what else they may have forgotten, as end users should not need to do any tracing ever for a production released app.

2 Likes

Kiitos paljon! Thank you - this is the solution (changing the value from 1 to 0) you figured out to keep OP app working with v72 on my C2 and 10III. This saved my day :slight_smile:

1 Like