3 ms·

I'm not addressing this comment so much as the "there's no reason banks should do this" replies to it. Detecting root and jailbreaks isn't something developers

by Youden 6y ago

I'm not addressing this comment so much as the "there's no reason banks should do this" replies to it. Detecting root and jailbreaks isn't something developers do just to prevent power-users from using their devices, or because they think power-users are shooting their security in the foot, it's about stopping malicious actors from attacking regular users. For example a piece of malware could achieve root and use it to read sensitive data from memory and log the user's inputs, including passwords and PIN codes. Malware has achieved root in the past, see the CopyCat malware on Android from a few years ago. This also applies to features like Secure Boot. It's not just there to make power-users' lives harder. Without it, a malicious party could, for example, buy a bunch of smartphones retail, flash them with a malicious ROM, sell them at a loss, then recover the loss by stealing money using the victims' information. These things also just break the security model of the platform they're on. It's hard to write a secure application when all the building blocks you're using could collapse at any time. Imagine writing a secure messaging app where someone could just replace all your crypto primitives. Wouldn't be easy, would it?

lucb1e 6y ago
This is of course the answer to why they're doing it: banks have no interest in making power users' lives harder, they just care about lining their pockets like every other business. But we do have to wonder if the upsides outweigh the downsides. Someone surreptitiously stealing and replacing a smartphone to install malware on it can happen, but will that ever be common? Someone could also surreptitiously install malware on a laptop, but I don't hear of that happening a lot. I don't know of any banking trojan that is typically installed via physical access. Do we want a world where people have no real ownership over their device anymore for this attack vector that has existed since day one but is rarely abused in the sort of attack that we're trying to prevent, or do we prefer a maker community to be able to exist? For example, F-Droid could not exist without Android allowing people to install software without needing Google's approval. A large part of the open source Android software is there and it's already fairly small due to the limitations that Android already put in place (F-Droid is large enough that I can replace nearly any apps with an open source alternative, but it's nothing like the community behind a Linux distribution). It's also not just banks. Indeed, banks might not care about restricting users other than as a means to minimize risk, but Google certainly has an advantage if everything has to go through them. And I understand the developers agreeing to code it up: they're not evil people, they are themselves and they know they and their colleagues aren't evil. Of course they would allow any reasonable app in the app/play/whatever store and people can enjoy the platform without worry. I see their perspective, but there's a bit more to it than that ideal.
saagarjha 6y ago
> Imagine writing a secure messaging app where someone could just replace all your crypto primitives. Wouldn't be easy, would it? It’s kind of impossible, is it not? Why try futile efforts to “detect” this?
- wool_gather 6y ago
  Why would that be impossible for malware with root privileges?
  - saagarjha 6y ago
    Impossible to detect.
- Youden 6y ago
  Theoretically, yes, it's impossible to detect this perfectly when the attacker can do whatever they want to your code and memory. Practically though, it's exactly as we see here: a kind of arms race or cat and mouse game where the attackers circumvent the detection and the detection evades the circumvention. So no, I don't think it's futile.
  - AnthonyMouse 6y ago
    They're not detecting the thing malware does, they're detecting the thing ordinary users do when they want control over their phones. Malware is different code so it has a different signature -- purposefully, because it has a strong incentive to not have these naive jailbreak detection methods work against it. So all they're doing is detecting false positives from innocent people and zero instances of real malware.

by Youden 6y ago

lucb1e 6y ago

This is of course the answer to why they're doing it: banks have no interest in making power users' lives harder, they just care about lining their pockets like every other business. But we do have to wonder if the upsides outweigh the downsides. Someone surreptitiously stealing and replacing a smartphone to install malware on it can happen, but will that ever be common? Someone could also surreptitiously install malware on a laptop, but I don't hear of that happening a lot. I don't know of any banking trojan that is typically installed via physical access. Do we want a world where people have no real ownership over their device anymore for this attack vector that has existed since day one but is rarely abused in the sort of attack that we're trying to prevent, or do we prefer a maker community to be able to exist? For example, F-Droid could not exist without Android allowing people to install software without needing Google's approval. A large part of the open source Android software is there and it's already fairly small due to the limitations that Android already put in place (F-Droid is large enough that I can replace nearly any apps with an open source alternative, but it's nothing like the community behind a Linux distribution). It's also not just banks. Indeed, banks might not care about restricting users other than as a means to minimize risk, but Google certainly has an advantage if everything has to go through them. And I understand the developers agreeing to code it up: they're not evil people, they are themselves and they know they and their colleagues aren't evil. Of course they would allow any reasonable app in the app/play/whatever store and people can enjoy the platform without worry. I see their perspective, but there's a bit more to it than that ideal.

saagarjha 6y ago

> Imagine writing a secure messaging app where someone could just replace all your crypto primitives. Wouldn't be easy, would it? It’s kind of impossible, is it not? Why try futile efforts to “detect” this?

wool_gather 6y ago
Why would that be impossible for malware with root privileges?
- saagarjha 6y ago
  Impossible to detect.
Youden 6y ago
Theoretically, yes, it's impossible to detect this perfectly when the attacker can do whatever they want to your code and memory. Practically though, it's exactly as we see here: a kind of arms race or cat and mouse game where the attackers circumvent the detection and the detection evades the circumvention. So no, I don't think it's futile.
- AnthonyMouse 6y ago
  They're not detecting the thing malware does, they're detecting the thing ordinary users do when they want control over their phones. Malware is different code so it has a different signature -- purposefully, because it has a strong incentive to not have these naive jailbreak detection methods work against it. So all they're doing is detecting false positives from innocent people and zero instances of real malware.