Hi,

It’s been years that I’m using Cyanogen, then now Lineage. Recently, I made a bargain and bought 2 Google Pixel 4a, one for me and one for my girlfriend.

I installed Lineage on both of them, and I have to say that it’s the best Android experience I had so far. We both love our device. It’s small, powerful enough, camera pictures are amazing.

However, we are unable to get any banking apps working. We would like to use 2 applications:

1. Payconiq: https://play.google.com/store/apps/details?id=mobi.inthepocket.bcmc.bancontact&hl=en&gl=US

2. Keytrade: https://play.google.com/store/apps/details?id=be.keytradebank.phone&hl=en&gl=US

I succeeded to get Payconiq working on my phone, using Magisk 23 and Magisk hide. So far so good.
Since this morning, Magisk has been updated to 24.1, Magisk hide is gone and I have to use Magisk Zygisk… And Payconiq doesn’t work anymore.

Regarding the second app “Keytrade”, it never worked, with any version of Magisk. I don’t know what they did in their app, but it seems that they were able to find a way to detect if a phone has a custom rom pretty nicely.

Maybe this is something that the author of Magisk should be aware of? Maybe I’m doing something wrong?

Do you have any piece of advice for me? I don’t want to be forced to re-install the official rom, I still want to use Lineage and have those apps working.

Thanks!

Edit: After installing the universal safetynet fix (https://github.com/kdrag0n/safetynet-fix), Payconiq works, but not Keytrade – Thanks /u/lightning407 !

5 comments

  1. I’m running (unrooted) LineageOS and the Keytrade app works just fine. If I recall correctly, my phone passes safetynet basic attestation but not the more strict one that payconiq checks.

    So I’m in exactly the reverse situation as you: I do not use magisk and can use the Keytrade app just fine, but payconiq tells me to fuck off.

    Apparently using an up-to-date non-rooted OS (LineageOS, Android 11 with weekly updates) is completely unsafe, while running the same app on an “end of life” device (Android 10, no more security updates) is super safe. Never mind that the device was end of life 3 years after it released (now 4 years ago). Completely insane that this is legal. End of life = may as well be e-waste despite working perfectly well.

  2. Apps involving money all much prefer to deal with the 99,9% tech illiterate customers who use their services in a very small number of standardized, predictable ways, rather than deal with 100% of customers. Using rooted or jailbroken devices and doing everything everyone else is doing, is a phantasy. Also, a lot of these “Why doesn’t company X allow me to use their services with my super-sophisticated setup?” posts are furthermore tech nerd humblebrags that reek of entitlement. “Excuse me, I’m smart enough to use a custom rom, you know. You companies should be glad to have smart people like me as customers.” No, they shouldn’t.

    Pick your poison: Google’s panopticon, Apple’s bloated mess where important security vulnerabilities don’t get patched for months, or manage your finances with your physical card, disconnected physical token and the browser. You can downvote this comment because you don’t like this answer, but it’s true just the same. I used Cyanogen around 2013 and it’s a tech nerd illusion that these things can be made to do everything a non-custom rom is allowed to do, even with hours of tinkering every week.

  3. There are probably always ways for an app to find out if it’s running on anything that’s not “regular” Android firmware. But the demographic running custom firmware is so small, that some developers (or at least their bosses) prefer to block their app on such a device. Because it’s easier(cheaper) to maintain full safety when you don’t have to take rooted phones into account.

    But if they want to do it this way, they should also stop their app from working on any device that’s behind on security/OS updates. But there are more people using old phones with regular firmware, than there are people with rooted firmware. The fact that a rooted Android will often be more secure than an old Android is not relevant to them. A rooted phone carries an inherent risk and banning it is easy and upset few people. Old OS’s also carry a risk, but banning them would upset many people.

  4. What about running Magisk with Zygisk and using the Denylist + Universal SafetyNet Fix? Maybe MagiskHide Props Config as well.

  5. I suspect kbc app checks against having apps like superuser and the like installed. Back in the day the app worked when I uninstalled that. But this is 5 years ago so YMMV.

Leave a Reply