4 ms·

Services like Android Pay quite reasonably elect to not work if the device appears like it may have been compromised. It's not easy to tell if a device is root

Services like Android Pay quite reasonably elect to not work if the device appears like it may have been compromised. It's not easy to tell if a device is rooted because the user wanted root access or because a virus got in. But suppose you established that the user intentionally rooted the phone (somehow). It'd still not be clear whether the rootkit that the user used was trustworthy. Even if you established that it was trustworthy (stretching the bounds of reasonableness; who is auditing these?), you couldn't assume that the user hadn't run other malicious programs. That last point is true for non-rooted phones, of course, but since this user had root access those hypothesized malicious programs become much more dangerous. (Also, I doubt you own or have root access to your credit card. But what would you do with it if you did? All I can come up with is to consolidate a few of them onto one piece of plastic.)

garaetjjte 10y ago
It's easy: just ask the user.
- lern_too_spel 10y ago
  As if the user knows if they've been rooted by a malicious third party.
darklajid 10y ago
Re: Credit card: I own one, I can hand it out. Most of the information necessary to use it (name, number, CSC) are available if you hold that card for a second. My (honest, I'm not trying to pull your leg or anything) question is: I have a phone. I own it. You (payment provider) cannot control it and I might do stupid things. I have a credit card. I own it. You (card issuer) cannot control it and I might do stupid things. Where's the difference? How can CCs work, but Android Pay/Samsung WhateverWhyWouldIUseIt doesn't, given my current impressions above. Can you correct my errors?
- kodroid 10y ago
  It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.
- ac29 10y ago
  Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities. I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.
- senectus1 10y ago
  its actually against the banks ToS to give your credit card to anyone else... even at the register. but everyone ignores that :-P
- notafurry 10y ago
  The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.

garaetjjte 10y ago

It's easy: just ask the user.

lern_too_spel 10y ago
As if the user knows if they've been rooted by a malicious third party.

darklajid 10y ago

Re: Credit card: I own one, I can hand it out. Most of the information necessary to use it (name, number, CSC) are available if you hold that card for a second. My (honest, I'm not trying to pull your leg or anything) question is: I have a phone. I own it. You (payment provider) cannot control it and I might do stupid things. I have a credit card. I own it. You (card issuer) cannot control it and I might do stupid things. Where's the difference? How can CCs work, but Android Pay/Samsung WhateverWhyWouldIUseIt doesn't, given my current impressions above. Can you correct my errors?

kodroid 10y ago
It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.
ac29 10y ago
Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities. I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.
senectus1 10y ago
its actually against the banks ToS to give your credit card to anyone else... even at the register. but everyone ignores that :-P
notafurry 10y ago
The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.