It’s probably NTP a lot of banking apps have extra protections and if it can’t determine the time from its own trusted authority it may not allow the connection.

So I just tested this. I'm not at home so I had to VPN in which is no issue.

• I opened graph.facebook.com and confirmed it was working
• I opened and logged in to my Ally app
• I added graph.facebook.com to my pi-hole's black list as a regex entry
• I opened graph.facebook.com in the browser and confirmed it was blocked
• I force closed and cleared the cache on my Ally app
• I opened and logged in to my Ally app

It's not the Meta connection that's giving you trouble.

Something else is going on with your setup, I block graph.facebook.com via DNS too and Ally works fine, both app and browser.

Your screenshot looks like you're also blocking ntp.org which could definitely screw with a banking app, and launchdarkly.com may also be the problem if they're loading assets from that service.

Try unblocking the ntp.org connections.

I know a software developer that worked for Ally when they were adding this. They all said it was a terrible idea, but were ignored. The reason they claim it’s needed is to track app installs that originate from an ad on Facebook. Since the App Store sits in between the ad click and App launch, there isn’t an easy way to track it without that. But, it shouldn’t be blocking you from logging in.

Unless you have a secondary timeserver set up, blocking pool.npt.org is going to mess up a lot of programs that are dependent on time.

File a complaint with the government. I’m not sure which agency, but there is definitely one for that.

Your screenshot does not really show anything other than the fact that Ally attempts a connection to Facebook (it's not even clear how it was blocked). You can see the amount of people telling you to unblock NTP, which you stated isn't blocked - that's a clear sign that you haven't presented you data in an easy to review format.

Why not show what exactly is blocked by the firewall, how the rules are configured, and disabling which rule exactly gets the app to work? E.g., if you block Facebook by redirecting to your own HTTP server that responds, the app may decide to bork because of a failed certificate validation - resolve the Facebook domain as NXDOMAIN in your DNS, and see if that helps.

The fact that they use Facebook APIs is infuriating, regardless.

According to Exodus Privacy (they analize mobile apps for trackers), Ally only contains Amazon and Google trackers (Google Firebase Analytics is used by almost all apps): https://reports.exodus-privacy.eu.org/en/reports/com.ally.MobileBanking/latest/

Others also say their Ally app doesn't connect to Facebook. Maybe you have a Unicorn or a modified app (rather unlikely though)?

If they do any sort of Facebook login/auth, frequently facebook will require them to send them data about ANYONE who is using their site.

It might be that they made the app fail if any of their outbound connections fail. This is very reasonable, as ideally the only calls the app should be making are the ones it needs to make to facilitate this functionality. So if connections fail, the functionality of the app can massively bork, potentially resulting in poorer customer service than if they simply showed a failure screen.

What's less reasonable is why graph.facebook.com is one of them. Why on earth would they be sending the most sensitive data of their clients to the least trustworthy of corporations?

Why do you block LaunchDarkly?

So this post prompted me to check my app connections (on iOS btw) and I realized I didn’t have NextDNS set 😓. It connects to a lot of Google domains and others, but not Facebook on my end.

Yeah that seems pretty gross.

All the technical discussion is interesting. But perhaps more importantly, is it time to consider a new bank?