I don't really agree with the description of the app: "the application that the bank provided sucked". What's the reason for this? The only thing he didn't like about the app was that when he reflashed the phone he had to re-register it. ("calling the bank every so often after changing ROMs, resetting or changing phones") Does that app suck? I don't think so, you should reauthorize the app on every new device and if reflashing your phone makes it look like a new device, that's not really the app's problem, is it?

> what do you think the bank will do? Hire him (or buy the app), or fight him?

Ignore. Most likely they didn't write the app, but rather contracted the work to some company that specialises in writing apps. There's no reason for the bank to hire him. He didn't produce any better app either.

I'm all in for a good rant about companies preventing reverse-engineering and modifications of software, but I really don't believe this is the right article for it.

He was able to reverse engineer the whole process. The bank's app definitely sucks.

Actually, being able to reverse-engineer and thus also being able to audit the processes and protocols being used is widely regarded to be a good thing, improving overall security standards.

You know that everything can be reverse engineered, right? It only depends on the time you're prepared to spend on the problem.

Huh? I installed dropbox without doing anything special. Gmail may not be installable from the internet, but gapps can be added without flashing the whole phone.

I meant you have to readd your accounts with the device when you flash a new ROM (even if you backed up the app and data previously). Poor English in my previous comment.

Could we at least wait for the bank to give its response before we start condemning it?

I doubt they will respond. I think they are unlikely to ever really find out. If they find out it is better for them to ignore it because an official response could be picked by main stream media and turn into bad PR for them. By ignoring this story will remain within 'our' very small community and the intersect of those that are Brazilian.

I find it so frustrating that many organisations put massive efforts into software that is very locked down and not as good as the community would provide for themselves and probably share for free.

This is particularly obvious in the case of media companies and banks. If they provided a nice API instead of specialised webapps, there'd be beautiful and more functional applications available for free to their customers within weeks.

German banks do this with the HBCI standard - some quirks aside, you can use the same banking app for nearly every bank in Germany.