9 ms·

I absolutely support people's right to jailbreak devices they own and over the years I've jailbroken my phone or ipad for one reason or another. Having said th

I absolutely support people's right to jailbreak devices they own and over the years I've jailbroken my phone or ipad for one reason or another. Having said that, unless there's something specific you're looking for, it's not really worth the effort these days and has potential downsides. The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating. There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated. Source: I used to work for a company that makes phone software that needs to be secure and so would attempt to detect jailbreaks.

unityByFreedom 6y ago
Is there a way to temporarily disable the jailbreak, then open/use the banking app, then re-enable jailbreak? Even if it required a reboot I'd be okay with it.
- WantonQuantum 6y ago
  The short answer is sometimes yes sometimes no. Some jailbreaking detection works by attempting things that wouldn't succeed on a non-jailbroken device and some detection works by looking for signs of specific jailbreaks. It's a real cat-and-mouse game.
- Lammy 6y ago
  unc0ver isn't one, but a "rootless" jailbreak is usually undetectable. This one hasn't been updated with iOS 13 support but was popular for iOS 12: https://pangu8.com/jailbreak/rootless-jb/ https://pangu8.com/jailbreak/rootless-jb/ I haven't used it myself, but two very similar kernel-level jailbreak detection bypasses were just released for unc0ver 13.x, FlyJB and KernBypass: https://github.com/akusio/KernBypass-Public https://github.com/akusio/KernBypass-Public A couple of my banking apps detect my jailbreak but allow me to continue after hitting "Okay". The only app I ever wanted to use that refused to let me in was the Nintendo Switch Online app. Steam works fine. If you don't play games on your phone it isn't really a big deal imo.
  - Wowfunhappy 6y ago
    “Rootless” Jailbreaks also severely limit what you can do, though.
    - Lammy 6y ago
      Yep, never used one myself for that reason. I saw a lot of praise for it from Pokémon Go players though :)
- update 6y ago
  yep. checkra1n for iOS 13.1 requires that you re-jailbreak every time you reboot your phone. Takes like 5 minutes to do. One of those cases where a bug really is a feature
deleted 6y ago
[deleted]
Wowfunhappy 6y ago
Any app that refuses to run because I'm Jailbroken isn't worth my time. Full stop. (If there's an app that's truly essential for you, I'm sorry, that's a shame. But I haven't encountered that in my many years of using Jailbroken iPhones.)
- choward 6y ago
  I agree. I have had rooted androids ever since I bought my first smart phone. I have never had an app refuse to load but that would piss me off. I want root access to my phone just like every other computer that I own. The root user is literally the owner of the device. If you don't have root access you don't own it as far as I'm concerned.
- fastball 6y ago
  There isn't really enough that is appealing about jailbreaking iOS at this point where I would forego 50% of my banking apps for it.
  - skinnymuch 6y ago
    You wouldn’t have to. I haven’t come across any app that doesn’t work with a jailbreak hider app.
    - fastball 6y ago
      I've come across a bunch. General there is a workaround, but I don't want to spend hours trying 3 different "jailbreak hiders" and finding a version of the app I can downgrade to using AppStore+ in order to use it normally. And since these are all tethered jailbreaks, I don't want to completely re-install a banking app that locks itself up after I open it in unjailbroken mode (so the hider isn't working, but their jailbreak detection still does) after my phone dies and I forgot to re-jailbreak it.
      - skinnymuch 6y ago
        Can you name a few that Liberty doesn’t get around? They aren’t tethered completely. More semi tethered. I haven’t reconnected any device to a computer to re-jailbreak in many months. Most devices can use unc0ver. In which case you have to be Un-jailbroken for close to 7 days in a row for ReProvision to not renew unc0ver. So that issue is a pretty big rarity.
choward 6y ago
> Having said that, unless there's something specific you're looking for, it's not really worth the effort these days and has potential downsides. > The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. So the biggest downside is a problem completely caused by humans on purpose? > There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating. The gaming thing is irrelevant to me. I'm not going to sacrifice actually owning my device so that I can play games. As for banking it only matters if you lose your phone (if it's not encrypted) or if you give root access to a malicious piece of software. But even then, why should it matter? Your banking app should still be secure, but it allows the developers to be lazier. You can also log into your banking site through a web portal on your phone anyway even if you have root access so it's completely arbitrary to disallow access to an app on your phone. And the fact that it's checking for that anyway creeps me out. Why is that everyone has has root/administrator access to their PCs but they are perfectly with using another computer that happens to be portable and not have root access. You supposedly own your phone, but if you don't have root access to it, I don't consider that as ownership. Whoever has root access to your phone owns it. > There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated. That's great. A pointless arms race that's a waste of people's time. I'm glad the developments in a real Linux phone are picking up. I'd rather be in full control of the software that runs on my device instead of relying some corporate overlords babysitting me.
- scarface74 6y ago
  Why is that everyone has has root/administrator access to their PCs but they are perfectly with using another computer that happens to be portable and not have root access. You supposedly own your phone, but if you don't have root access to it, I don't consider that as ownership. Whoever has root access to your phone owns it. How has that been working out for the last 20+ years for the average consumer? How much more careful are you about installing random crap on your computer compared to your typical iOS device?
AnthonyMouse 6y ago
> There are obvious security reasons for apps like banking apps to do this This is obviously wrong. It's possible to do the same banking things using the bank's website both from general purpose PCs and browsers on phones for which jailbreak detection is not possible in the browser. Jailbreak detection is done by testing for the presence of common things that allow the device owner to control the device. The device owner controlling the device is not a problem for banking. Meanwhile a malicious third party wouldn't inherently need to make use of any of those and would have strong incentives to avoid using any that trigger jailbreak detection, so it's no help there either. And for the same reason it's basically useless for detecting cheating. Because if you jailbreak your phone so you can install some apps from outside the store and then it breaks your games, you might grumble and decide you want to play the game more. But if you jailbreak your phone because you want to cheat at games, your next step is to thwart the jailbreak detection, which is not that hard when you have the game software to inspect to see how it's doing jailbreak detection. And you can also tell when the app is updated and then run the new version on a test machine to see how the new version is doing jailbreak detection. It's hostile and a waste of time to do this when you're going to lose anyway. You only inconvenience the people who jailbreak their phones for completely unrelated reasons.
- spideymans 6y ago
  If banks could secure their web portals to the same degree as their mobile apps, they absolutely would. “Portal A (web) cant be as secure as Portal B (mobile), so don’t bother securing Portal B” isn’t an acceptable security model. The banks are naturally going to reduce their vectors of attack to the greatest degree possible, and that naturally means that some access points will be more secure than others.
  - cookiengineer 6y ago
    I am not sure where you come from, but around Europe banks are the worst when it comes to security audits, and they don’t give a damn about it. From trying to roll their own crypto, to still using legacy ssl to support ie6...everything is shitty. Even when they are forced by law [1] to integrate modern 2FA, they find ways to implement it in a shitty, proprietary way. PSD2 is required since September 2019 and every single bank rolled it out in August and waited until the very last moment. I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]? [1] https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] https://tools.ietf.org/html/ https://tools.ietf.org/html/ [3] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
userbinator 6y ago
The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. If you are truly root, and the apps are not, then it's theoretically always possible to give them "the reality they want to see".
- saagarjha 6y ago
  And indeed there is a cottage industry of “jailbreak hider” tools available for exactly this.
drdaeman 6y ago
> phone software that needs to be secure and so would attempt to detect jailbreaks Ah, yes, the same kind of software that forbids pasting passwords, because, security. Although, to be fair, I must admit, the comparison is not entirely accurate. It is true that it makes some sense. I don't know about iOS jailbreaks, but on Android an application may request superuser privileges. Given that a significant fraction of users do tend to grant arbitrary permissions to see the flying pigs (numerous Android flashlight apps are a good example), I can see how this could be a problem. I believe I've heard of malware that does this. That's why my latest Android phones haven't had user-facing root access or Xposed. The idea was that there was nothing installable/programmable (that I could grant by fat-fingering or someone could borrow/steal my phone and exploit the elevated capabilities) - just a custom-built firmware with everything I needed. I haven't yet felt a particular necessity to jailbreak my iPhone (although apps get worse every year so I may eventually consider it), so no experience in that regard.
- lucb1e 6y ago
  > a significant fraction of users do tend to grant arbitrary permissions [...] That's why my latest Android phones haven't had user-facing root access or Xposed Wait, you're worried you'll give something root without noticing? I can understand if you're worried about your mom doing that if you rooted her phone, but yourself? (About rooting one's mom's phone, anecdotally I wish I had done that. She keeps getting notifications from Sony, the manufacturer, and things are just not customizable to suit her. When my grandma got a new smartphone a bit more recently, I rooted hers and then just set the supersu default to deny so she'd never get the prompt, and she's much happier with her phone. I've been considering rooting my mom's but the device wipe is such a pain, especially since you can't do app data backups without root (another reason to root: make actual backups). Android really needs an Apple iTunes-like backup system.)
  - drdaeman 6y ago
    Not without noticing, but accidentally fat-fingering the “allow” button. TBH, I just didn’t need root access “on the go” - so, when I’ve decided I wanted to build my own image, I just haven’t found a reason/use case to include it. I had the full flash backups, an adblocker, a patch for clipboard read permission and a few UI customizations. And ability to add more stuff. That was all I needed. A shame I had no control over bootloader and wasn’t able to truly lock down the device to my own signing keys.
saagarjha 6y ago
> There are obvious security reasons for apps like banking apps to do this There are exactly zero reasons why a bank should be doing this and I would be quite pleased if Apple instituted rules against doing this kind of fingerprinting.
- trollied 6y ago
  That is not true at all. If an iOS device is jailbroken the bank has to assume the worst, which is that the device is compromised and has malware. I don’t blame them, they’re mitigating another potential risk. Malware that’s essentially a rootkit could send your bank login details to a malicious third party in realtime, for example. 2FA codes and all. Also remember there are lots of people out there that aren’t as tech savvy as the HN readership. A random person that just wants some springboard tweaks or similar may not verify where these tweaks came from & not understand the consequences of installing essentially untrusted software.
  - saagarjha 6y ago
    > If an iOS device is jailbroken the bank has to assume the worst, which is that the device is compromised and has malware. This is 100x worse in browsers on desktops, where the percentage of people who install things like browser extensions or persistent malware is non-neglible. Yet banks largely accept that as OK, and if someone’s bank’s website decided to probe the filesystem for “evidence” of malware would 1. cause a huge scandal and 2. immediately cause malware to hide itself from the detection.
Youden 6y ago
I'm not addressing this comment so much as the "there's no reason banks should do this" replies to it. Detecting root and jailbreaks isn't something developers do just to prevent power-users from using their devices, or because they think power-users are shooting their security in the foot, it's about stopping malicious actors from attacking regular users. For example a piece of malware could achieve root and use it to read sensitive data from memory and log the user's inputs, including passwords and PIN codes. Malware has achieved root in the past, see the CopyCat malware on Android from a few years ago. This also applies to features like Secure Boot. It's not just there to make power-users' lives harder. Without it, a malicious party could, for example, buy a bunch of smartphones retail, flash them with a malicious ROM, sell them at a loss, then recover the loss by stealing money using the victims' information. These things also just break the security model of the platform they're on. It's hard to write a secure application when all the building blocks you're using could collapse at any time. Imagine writing a secure messaging app where someone could just replace all your crypto primitives. Wouldn't be easy, would it?
- lucb1e 6y ago
  This is of course the answer to why they're doing it: banks have no interest in making power users' lives harder, they just care about lining their pockets like every other business. But we do have to wonder if the upsides outweigh the downsides. Someone surreptitiously stealing and replacing a smartphone to install malware on it can happen, but will that ever be common? Someone could also surreptitiously install malware on a laptop, but I don't hear of that happening a lot. I don't know of any banking trojan that is typically installed via physical access. Do we want a world where people have no real ownership over their device anymore for this attack vector that has existed since day one but is rarely abused in the sort of attack that we're trying to prevent, or do we prefer a maker community to be able to exist? For example, F-Droid could not exist without Android allowing people to install software without needing Google's approval. A large part of the open source Android software is there and it's already fairly small due to the limitations that Android already put in place (F-Droid is large enough that I can replace nearly any apps with an open source alternative, but it's nothing like the community behind a Linux distribution). It's also not just banks. Indeed, banks might not care about restricting users other than as a means to minimize risk, but Google certainly has an advantage if everything has to go through them. And I understand the developers agreeing to code it up: they're not evil people, they are themselves and they know they and their colleagues aren't evil. Of course they would allow any reasonable app in the app/play/whatever store and people can enjoy the platform without worry. I see their perspective, but there's a bit more to it than that ideal.
temp43t453 6y ago
while warning part is valid, it's a little bit strange to see this on developing related website. regarding the detection and added security - this is security through obscurity which has more downsides than protection it provides. not discussing the loss of privileges for device owner

unityByFreedom 6y ago

Is there a way to temporarily disable the jailbreak, then open/use the banking app, then re-enable jailbreak? Even if it required a reboot I'd be okay with it.

WantonQuantum 6y ago
The short answer is sometimes yes sometimes no. Some jailbreaking detection works by attempting things that wouldn't succeed on a non-jailbroken device and some detection works by looking for signs of specific jailbreaks. It's a real cat-and-mouse game.
Lammy 6y ago
unc0ver isn't one, but a "rootless" jailbreak is usually undetectable. This one hasn't been updated with iOS 13 support but was popular for iOS 12: https://pangu8.com/jailbreak/rootless-jb/ https://pangu8.com/jailbreak/rootless-jb/ I haven't used it myself, but two very similar kernel-level jailbreak detection bypasses were just released for unc0ver 13.x, FlyJB and KernBypass: https://github.com/akusio/KernBypass-Public https://github.com/akusio/KernBypass-Public A couple of my banking apps detect my jailbreak but allow me to continue after hitting "Okay". The only app I ever wanted to use that refused to let me in was the Nintendo Switch Online app. Steam works fine. If you don't play games on your phone it isn't really a big deal imo.
- Wowfunhappy 6y ago
  “Rootless” Jailbreaks also severely limit what you can do, though.
  - Lammy 6y ago
    Yep, never used one myself for that reason. I saw a lot of praise for it from Pokémon Go players though :)
update 6y ago
yep. checkra1n for iOS 13.1 requires that you re-jailbreak every time you reboot your phone. Takes like 5 minutes to do. One of those cases where a bug really is a feature

deleted 6y ago

[deleted]

Wowfunhappy 6y ago

Any app that refuses to run because I'm Jailbroken isn't worth my time. Full stop. (If there's an app that's truly essential for you, I'm sorry, that's a shame. But I haven't encountered that in my many years of using Jailbroken iPhones.)

choward 6y ago
I agree. I have had rooted androids ever since I bought my first smart phone. I have never had an app refuse to load but that would piss me off. I want root access to my phone just like every other computer that I own. The root user is literally the owner of the device. If you don't have root access you don't own it as far as I'm concerned.
fastball 6y ago
There isn't really enough that is appealing about jailbreaking iOS at this point where I would forego 50% of my banking apps for it.
- skinnymuch 6y ago
  You wouldn’t have to. I haven’t come across any app that doesn’t work with a jailbreak hider app.
  - fastball 6y ago
    I've come across a bunch. General there is a workaround, but I don't want to spend hours trying 3 different "jailbreak hiders" and finding a version of the app I can downgrade to using AppStore+ in order to use it normally. And since these are all tethered jailbreaks, I don't want to completely re-install a banking app that locks itself up after I open it in unjailbroken mode (so the hider isn't working, but their jailbreak detection still does) after my phone dies and I forgot to re-jailbreak it.
    - skinnymuch 6y ago
      Can you name a few that Liberty doesn’t get around? They aren’t tethered completely. More semi tethered. I haven’t reconnected any device to a computer to re-jailbreak in many months. Most devices can use unc0ver. In which case you have to be Un-jailbroken for close to 7 days in a row for ReProvision to not renew unc0ver. So that issue is a pretty big rarity.

choward 6y ago

> Having said that, unless there's something specific you're looking for, it's not really worth the effort these days and has potential downsides. > The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. So the biggest downside is a problem completely caused by humans on purpose? > There are obvious security reasons for apps like banking apps to do this but also many online gaming apps won't run if they detect that the device is jailbroken in order to deter cheating. The gaming thing is irrelevant to me. I'm not going to sacrifice actually owning my device so that I can play games. As for banking it only matters if you lose your phone (if it's not encrypted) or if you give root access to a malicious piece of software. But even then, why should it matter? Your banking app should still be secure, but it allows the developers to be lazier. You can also log into your banking site through a web portal on your phone anyway even if you have root access so it's completely arbitrary to disallow access to an app on your phone. And the fact that it's checking for that anyway creeps me out. Why is that everyone has has root/administrator access to their PCs but they are perfectly with using another computer that happens to be portable and not have root access. You supposedly own your phone, but if you don't have root access to it, I don't consider that as ownership. Whoever has root access to your phone owns it. > There's an ongoing arms-race between app developers and jailbreakers where jailbreakers try to avoid detection and app developers find new ways to detect jailbreaks. So a new jailbreak will probably not be detected until a few weeks or months later when the app is updated. That's great. A pointless arms race that's a waste of people's time. I'm glad the developments in a real Linux phone are picking up. I'd rather be in full control of the software that runs on my device instead of relying some corporate overlords babysitting me.

scarface74 6y ago
Why is that everyone has has root/administrator access to their PCs but they are perfectly with using another computer that happens to be portable and not have root access. You supposedly own your phone, but if you don't have root access to it, I don't consider that as ownership. Whoever has root access to your phone owns it. How has that been working out for the last 20+ years for the average consumer? How much more careful are you about installing random crap on your computer compared to your typical iOS device?

AnthonyMouse 6y ago

> There are obvious security reasons for apps like banking apps to do this This is obviously wrong. It's possible to do the same banking things using the bank's website both from general purpose PCs and browsers on phones for which jailbreak detection is not possible in the browser. Jailbreak detection is done by testing for the presence of common things that allow the device owner to control the device. The device owner controlling the device is not a problem for banking. Meanwhile a malicious third party wouldn't inherently need to make use of any of those and would have strong incentives to avoid using any that trigger jailbreak detection, so it's no help there either. And for the same reason it's basically useless for detecting cheating. Because if you jailbreak your phone so you can install some apps from outside the store and then it breaks your games, you might grumble and decide you want to play the game more. But if you jailbreak your phone because you want to cheat at games, your next step is to thwart the jailbreak detection, which is not that hard when you have the game software to inspect to see how it's doing jailbreak detection. And you can also tell when the app is updated and then run the new version on a test machine to see how the new version is doing jailbreak detection. It's hostile and a waste of time to do this when you're going to lose anyway. You only inconvenience the people who jailbreak their phones for completely unrelated reasons.

spideymans 6y ago
If banks could secure their web portals to the same degree as their mobile apps, they absolutely would. “Portal A (web) cant be as secure as Portal B (mobile), so don’t bother securing Portal B” isn’t an acceptable security model. The banks are naturally going to reduce their vectors of attack to the greatest degree possible, and that naturally means that some access points will be more secure than others.
- cookiengineer 6y ago
  I am not sure where you come from, but around Europe banks are the worst when it comes to security audits, and they don’t give a damn about it. From trying to roll their own crypto, to still using legacy ssl to support ie6...everything is shitty. Even when they are forced by law [1] to integrate modern 2FA, they find ways to implement it in a shitty, proprietary way. PSD2 is required since September 2019 and every single bank rolled it out in August and waited until the very last moment. I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]? [1] https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] https://tools.ietf.org/html/ https://tools.ietf.org/html/ [3] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238

userbinator 6y ago

The biggest downside is that you might find some existing apps on your phone can detect that the phone is jailbroken and refuse to start. If you are truly root, and the apps are not, then it's theoretically always possible to give them "the reality they want to see".

saagarjha 6y ago
And indeed there is a cottage industry of “jailbreak hider” tools available for exactly this.

drdaeman 6y ago

> phone software that needs to be secure and so would attempt to detect jailbreaks Ah, yes, the same kind of software that forbids pasting passwords, because, security. Although, to be fair, I must admit, the comparison is not entirely accurate. It is true that it makes some sense. I don't know about iOS jailbreaks, but on Android an application may request superuser privileges. Given that a significant fraction of users do tend to grant arbitrary permissions to see the flying pigs (numerous Android flashlight apps are a good example), I can see how this could be a problem. I believe I've heard of malware that does this. That's why my latest Android phones haven't had user-facing root access or Xposed. The idea was that there was nothing installable/programmable (that I could grant by fat-fingering or someone could borrow/steal my phone and exploit the elevated capabilities) - just a custom-built firmware with everything I needed. I haven't yet felt a particular necessity to jailbreak my iPhone (although apps get worse every year so I may eventually consider it), so no experience in that regard.

lucb1e 6y ago
> a significant fraction of users do tend to grant arbitrary permissions [...] That's why my latest Android phones haven't had user-facing root access or Xposed Wait, you're worried you'll give something root without noticing? I can understand if you're worried about your mom doing that if you rooted her phone, but yourself? (About rooting one's mom's phone, anecdotally I wish I had done that. She keeps getting notifications from Sony, the manufacturer, and things are just not customizable to suit her. When my grandma got a new smartphone a bit more recently, I rooted hers and then just set the supersu default to deny so she'd never get the prompt, and she's much happier with her phone. I've been considering rooting my mom's but the device wipe is such a pain, especially since you can't do app data backups without root (another reason to root: make actual backups). Android really needs an Apple iTunes-like backup system.)
- drdaeman 6y ago
  Not without noticing, but accidentally fat-fingering the “allow” button. TBH, I just didn’t need root access “on the go” - so, when I’ve decided I wanted to build my own image, I just haven’t found a reason/use case to include it. I had the full flash backups, an adblocker, a patch for clipboard read permission and a few UI customizations. And ability to add more stuff. That was all I needed. A shame I had no control over bootloader and wasn’t able to truly lock down the device to my own signing keys.

saagarjha 6y ago

> There are obvious security reasons for apps like banking apps to do this There are exactly zero reasons why a bank should be doing this and I would be quite pleased if Apple instituted rules against doing this kind of fingerprinting.

trollied 6y ago
That is not true at all. If an iOS device is jailbroken the bank has to assume the worst, which is that the device is compromised and has malware. I don’t blame them, they’re mitigating another potential risk. Malware that’s essentially a rootkit could send your bank login details to a malicious third party in realtime, for example. 2FA codes and all. Also remember there are lots of people out there that aren’t as tech savvy as the HN readership. A random person that just wants some springboard tweaks or similar may not verify where these tweaks came from & not understand the consequences of installing essentially untrusted software.
- saagarjha 6y ago
  > If an iOS device is jailbroken the bank has to assume the worst, which is that the device is compromised and has malware. This is 100x worse in browsers on desktops, where the percentage of people who install things like browser extensions or persistent malware is non-neglible. Yet banks largely accept that as OK, and if someone’s bank’s website decided to probe the filesystem for “evidence” of malware would 1. cause a huge scandal and 2. immediately cause malware to hide itself from the detection.

Youden 6y ago

I'm not addressing this comment so much as the "there's no reason banks should do this" replies to it. Detecting root and jailbreaks isn't something developers do just to prevent power-users from using their devices, or because they think power-users are shooting their security in the foot, it's about stopping malicious actors from attacking regular users. For example a piece of malware could achieve root and use it to read sensitive data from memory and log the user's inputs, including passwords and PIN codes. Malware has achieved root in the past, see the CopyCat malware on Android from a few years ago. This also applies to features like Secure Boot. It's not just there to make power-users' lives harder. Without it, a malicious party could, for example, buy a bunch of smartphones retail, flash them with a malicious ROM, sell them at a loss, then recover the loss by stealing money using the victims' information. These things also just break the security model of the platform they're on. It's hard to write a secure application when all the building blocks you're using could collapse at any time. Imagine writing a secure messaging app where someone could just replace all your crypto primitives. Wouldn't be easy, would it?

lucb1e 6y ago
This is of course the answer to why they're doing it: banks have no interest in making power users' lives harder, they just care about lining their pockets like every other business. But we do have to wonder if the upsides outweigh the downsides. Someone surreptitiously stealing and replacing a smartphone to install malware on it can happen, but will that ever be common? Someone could also surreptitiously install malware on a laptop, but I don't hear of that happening a lot. I don't know of any banking trojan that is typically installed via physical access. Do we want a world where people have no real ownership over their device anymore for this attack vector that has existed since day one but is rarely abused in the sort of attack that we're trying to prevent, or do we prefer a maker community to be able to exist? For example, F-Droid could not exist without Android allowing people to install software without needing Google's approval. A large part of the open source Android software is there and it's already fairly small due to the limitations that Android already put in place (F-Droid is large enough that I can replace nearly any apps with an open source alternative, but it's nothing like the community behind a Linux distribution). It's also not just banks. Indeed, banks might not care about restricting users other than as a means to minimize risk, but Google certainly has an advantage if everything has to go through them. And I understand the developers agreeing to code it up: they're not evil people, they are themselves and they know they and their colleagues aren't evil. Of course they would allow any reasonable app in the app/play/whatever store and people can enjoy the platform without worry. I see their perspective, but there's a bit more to it than that ideal.

temp43t453 6y ago

while warning part is valid, it's a little bit strange to see this on developing related website. regarding the detection and added security - this is security through obscurity which has more downsides than protection it provides. not discussing the loss of privileges for device owner