Ask HN: Implications of open-source banking apps?

As there aren't any alternative FOSS apps, the customer cannot use these banking applications as intended.

I was therefore wondering, what would be the implications for an average, mid-sized bank, to go completely open source? How feasible is it building such an app/transaction system especially regarding privacy and security measures (required by law)? And lastly, what organizational changes within the bank would be needed to make an open source friendly banking system possible?

This is hypothetical and solely out of curiosity. I am looking forward to the discussion. Thank you very much!

With closed source apps — as soon as you write for the JVM or in JS (i.e. Android and Web), you’re exposing the inner workings of your app… more or less. With C/C++ and similar stacks (read: Desktop or iOS or native parts of Android), one could argue that you expose less. But still, all code on clients is exposed, theoretically, so either way I don’t believe that open code itself would be much more problematic than what code is today in closed source apps. We did a bunch of things that are considered safety measures, and those could be coded into an OSS app as well.

But then, there is network encryption, potential implementations of cert pinning, integrations with other services/tools, secret keys, local storage, databases, and many other things that might be hard to lock down completely or even audit for security risks… this was the really tough part I believed. But maybe it’s just my knowledge gap, that’s fair as well.

In the end, my thinking was “omg I’d miss something for sure, and it would be easy for hackers to kill the project and steal everything”… and therefore OSS is not the way to go. I’m more confident nowadays. But then again, cryptocurrencies are open for the most part… so that’s an interesting counter-argument I guess. (:

I wonder what others think. I also wonder if there are open tools or checklists for security audits…

Nevertheless, using a banking app is very quick and convenient and is therefore used by many people. I don't see privacy education going that far, that people would abandon this convenience. Therefore I was wondering if an open source application would be possible here and bring the benefits that OSS usually offers in other circumstances.

It's used by most people because they've been taught to think "app".

Most people don't even know they have an alternative --- they don't know that they can easily make a link on their home screen to any web site that will look and function just like an app.

"Progressive web apps" even remove the browser interface so the casual user can't tell that they're not using an app. Chase; for example, has one.

It's also amazing how many developers don't know about PWAs and how they can be used to bypass the politics and extortion of app stores.

https://en.wikipedia.org/wiki/Progressive_web_application

The only reason PWAs aren't more popular is because app stores don't earn anything from them and they can't be used to data mine your phone.