5 ms·

100% sure that all decent banking app use device fingerprinting. 100% sure that it is not breaking the rules and it is really important that they keep doing it.

weeks 10y ago
While you're right that a lot of FinTech applications do use fingerprinting, it is absolutely against the rules. It's rather annoying from a mobile security perspective but given the rampant abuse of persistent device identifiers on Android, I understand and appreciate Apple's stance here.
- the_mitsuhiko 10y ago
  > While you're right that a lot of FinTech applications do use fingerprinting Do they really? [Citation needed] very much here. Which fintech app fingerprints devices? What would even be the point of doing that. You can persist a token in the keychain for that which is enough unless you are devious.
scarface74 10y ago
Why would a banking app need to use device fingerprinting?
- greenyoda 10y ago
  Perhaps to identify a device from which a fraudulent transaction occurred in the past?
  - user5994461 10y ago
    Because you don't want any phone in the world to be allowed to access any bank account in the world by just giving a name and password. Fingerprinting is a form of 2 factor authentication, it's easy to perform and it's relatively efficient against fraud.
    - sulam 10y ago
      If they're doing this on iOS, which is where it's interesting (in that it violates Apple's policies), they have a perfectly good 2-factor solution already present -- your finger.
    - LoSboccacc 10y ago
      as if used phones market doesn't exists
      - scarface74 10y ago
        Your fingerprint is never sent to the app. The first time you use an app you have to enter your user name and password and that is stored in the secure enclave that not even the operating system had access to. When the banking app request validation, you use your fingerprint to authenticate and the secure enclave sends the username and password to the app. The fingerprint scanner is connected directly to the secure enclave. When you sell your phone, you go through the process of erasing your phone, the encryption key is destroyed and your fingerprint is no longer valid.

weeks 10y ago

While you're right that a lot of FinTech applications do use fingerprinting, it is absolutely against the rules. It's rather annoying from a mobile security perspective but given the rampant abuse of persistent device identifiers on Android, I understand and appreciate Apple's stance here.

the_mitsuhiko 10y ago
> While you're right that a lot of FinTech applications do use fingerprinting Do they really? [Citation needed] very much here. Which fintech app fingerprints devices? What would even be the point of doing that. You can persist a token in the keychain for that which is enough unless you are devious.

scarface74 10y ago

Why would a banking app need to use device fingerprinting?

greenyoda 10y ago
Perhaps to identify a device from which a fraudulent transaction occurred in the past?
- user5994461 10y ago
  Because you don't want any phone in the world to be allowed to access any bank account in the world by just giving a name and password. Fingerprinting is a form of 2 factor authentication, it's easy to perform and it's relatively efficient against fraud.
  - sulam 10y ago
    If they're doing this on iOS, which is where it's interesting (in that it violates Apple's policies), they have a perfectly good 2-factor solution already present -- your finger.
  - LoSboccacc 10y ago
    as if used phones market doesn't exists
    - scarface74 10y ago
      Your fingerprint is never sent to the app. The first time you use an app you have to enter your user name and password and that is stored in the secure enclave that not even the operating system had access to. When the banking app request validation, you use your fingerprint to authenticate and the secure enclave sends the username and password to the app. The fingerprint scanner is connected directly to the secure enclave. When you sell your phone, you go through the process of erasing your phone, the encryption key is destroyed and your fingerprint is no longer valid.