6 ms·

> In order to combat these threats, the FBI recommended that Americans only download banking apps from official app stores or from banking websites. I would li

> In order to combat these threats, the FBI recommended that Americans only download banking apps from official app stores or from banking websites. I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from.

hcurtiss 6y ago
Agreed. Otherwise, modern mobile OSs are pretty tough to penetrate. iOS in particular.
- _bxg1 6y ago
  I pretty much exclusively use my iPhone for financial services specifically because it's so much less insecure than even the best desktop OS.
  - thephyber 6y ago
    It's been a lifesaver to reduce my IT time taken to clear family computers of malware since getting them iPads.
- rmrfstar 6y ago
  > iOS in particular False [1,2]. For a while iOS was hanging in there because persistence was difficult, but not anymore. Banking on your phone, unless it is a segregated account with limited funds, is a seriously bad idea. [1] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z... [2] https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply/ https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply...
  - saagarjha 6y ago
    Your links fail to support the point that banking on your phone is a "seriously bad idea".
    - rmrfstar 6y ago
      It supports the conclusion that iOS is not the security miracle people sometimes claim it is. If your device can be persistently compromised and you use it for general purpose browsing/email, it follows that using it to manage your money is a seriously bad idea.
      - saagarjha 6y ago
        I haven’t heard of anyone persistently compromising iOS for quite a long time. Regardless, your links do point towards iOS having issues with security, but they still don’t support the claim that you shouldn’t use it for online banking. The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars and nobody is going to leverage on of those to part you from a couple thousand dollars–it just wouldn’t make sense. Those kinds of vulnerabilities are almost exclusively aimed at individuals or small groups of people for generally political motivations.
        rmrfstar 6y ago
        > The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars I linked an article that says the opposite. > I haven’t heard of anyone persistently compromising iOS for quite a long time a thread from a few weeks ago: https://news.ycombinator.com/item?id=23287364 https://news.ycombinator.com/item?id=23287364 > nobody is going to leverage on of those to part you from a couple thousand dollars If the cost of countering the threat is using a $40 Raspberry Pi to do your banking, what's the problem?
        frank2 6y ago
        >using a $40 Raspberry Pi to do your banking So exploits for iOS have recently been published whereas Linux and Firefox have warm and fuzzy associations, so clearly Linux and Firefox will work better than iOS in this case. Is that your argument? (I mention Firefox because all of the online banking arrangements I know of rely on iOS, Android or a web browser.)
Alupis 6y ago
More likely getting a spoofed email suggesting they download the Bank's latest-and-greatest app by clicking the link.
thephyber 6y ago
As someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in > who would download their banking apps from hax0rs.rus Having empathy with users that don't act perfectly skeptical 100% of the time and who don't read all of the text (like none of us read 100% of the EULAs every time we click the "accept terms" button/checkbox) will allow us to build systems which are more robust to the occasional distracted user, overlooked typo, user who doesn't know how o mentally parse a URL to identify the domain, etc. Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores. It's ridiculously easy not to accidentally download an iOS app from a 3rd party app store, because they simply aren't possible without jailbreak / install developer cert.
- henryfjordan 6y ago
  > Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app store I think most (myself included) are just advocating for Apple to allow side-loading. They can keep their app store intact. See https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper for more about an ongoing case
  - wonderlg 6y ago
    You mean installing apps via your less-safe computer? Browsers used to allow any software to side-load extensions and you know how that went: They all moved to store-only installs because all kinds of software were able to affect the browsers. Same way for side-loading apps to your phone. Sure it’s more difficult than just tapping something on the web, but it doesn’t mean it’s safe for the end user.
    - Larrikin 6y ago
      Please don't use the term all browsers when referring to Chrome. A situation like Ad Nauseum and Chrome would never arise on Firefox.
flattone 6y ago
How about urgent app security update email from Customerprotection@Yourbank.com Probably even my tech/developer etc friends some might click that update.
outime 6y ago
Who'd input the credit card on a random website that has suspicious discounts? Who'd give his SSN through the phone to someone saying the bank is calling to verify some details? Who'd believe an email saying that it's the bank and you need to update your app ASAP by clicking on this link or you'll lose access to your account? They (or we) are not stupid, they just don't know better and we should try to shield them from these risks as much as possible.
wonderlg 6y ago
Look up “boa login”, tap ad, YOUR PHONE HAS A VIRUS, tap to install. Suddenly you have a bank app on your phone. You’re welcome. This happens more often than you’d think. It’s even easier when you get targeted attacks via sms saying approximately the same thing. People don’t look at the URL bar.
dheera 6y ago
The user might have downloaded an APK from a phishing website, or received an APK by e-mail claiming to be from their bank.
grawprog 6y ago
>I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from. I'm guessing the people that believe the hax0rs.rus version believes something like, 'get extra money on each deposit with our hacked version' or 'don't like bank fees?? Try the hax0rs.rus version to avoid those pesky bank fees'. But more realistically, I imagine it's people clicking fraudulent links disguised as legitimate looking things from their bank. As apparent as things like that may seem to people who understand the web, it's not always obvious to people who haven't spent a million hours on the internet. Most people eventually learn to pick up a sense about what's legit and not on the web, but it really does take a long time. I'm sure at some point over all your years of computing and interneting you've probably downloaded at least one shady application or clicked one sketchy link by mistake, I know I have, and if you haven't I commend you honestly.

hcurtiss 6y ago

Agreed. Otherwise, modern mobile OSs are pretty tough to penetrate. iOS in particular.

_bxg1 6y ago
I pretty much exclusively use my iPhone for financial services specifically because it's so much less insecure than even the best desktop OS.
- thephyber 6y ago
  It's been a lifesaver to reduce my IT time taken to clear family computers of malware since getting them iPads.
rmrfstar 6y ago
> iOS in particular False [1,2]. For a while iOS was hanging in there because persistence was difficult, but not anymore. Banking on your phone, unless it is a segregated account with limited funds, is a seriously bad idea. [1] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z... [2] https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply/ https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply...
- saagarjha 6y ago
  Your links fail to support the point that banking on your phone is a "seriously bad idea".
  - rmrfstar 6y ago
    It supports the conclusion that iOS is not the security miracle people sometimes claim it is. If your device can be persistently compromised and you use it for general purpose browsing/email, it follows that using it to manage your money is a seriously bad idea.
    - saagarjha 6y ago
      I haven’t heard of anyone persistently compromising iOS for quite a long time. Regardless, your links do point towards iOS having issues with security, but they still don’t support the claim that you shouldn’t use it for online banking. The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars and nobody is going to leverage on of those to part you from a couple thousand dollars–it just wouldn’t make sense. Those kinds of vulnerabilities are almost exclusively aimed at individuals or small groups of people for generally political motivations.
      - rmrfstar 6y ago
        > The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars I linked an article that says the opposite. > I haven’t heard of anyone persistently compromising iOS for quite a long time a thread from a few weeks ago: https://news.ycombinator.com/item?id=23287364 https://news.ycombinator.com/item?id=23287364 > nobody is going to leverage on of those to part you from a couple thousand dollars If the cost of countering the threat is using a $40 Raspberry Pi to do your banking, what's the problem?
        frank2 6y ago
        >using a $40 Raspberry Pi to do your banking So exploits for iOS have recently been published whereas Linux and Firefox have warm and fuzzy associations, so clearly Linux and Firefox will work better than iOS in this case. Is that your argument? (I mention Firefox because all of the online banking arrangements I know of rely on iOS, Android or a web browser.)

Alupis 6y ago

More likely getting a spoofed email suggesting they download the Bank's latest-and-greatest app by clicking the link.

thephyber 6y ago

As someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in > who would download their banking apps from hax0rs.rus Having empathy with users that don't act perfectly skeptical 100% of the time and who don't read all of the text (like none of us read 100% of the EULAs every time we click the "accept terms" button/checkbox) will allow us to build systems which are more robust to the occasional distracted user, overlooked typo, user who doesn't know how o mentally parse a URL to identify the domain, etc. Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores. It's ridiculously easy not to accidentally download an iOS app from a 3rd party app store, because they simply aren't possible without jailbreak / install developer cert.

henryfjordan 6y ago
> Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app store I think most (myself included) are just advocating for Apple to allow side-loading. They can keep their app store intact. See https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper for more about an ongoing case
- wonderlg 6y ago
  You mean installing apps via your less-safe computer? Browsers used to allow any software to side-load extensions and you know how that went: They all moved to store-only installs because all kinds of software were able to affect the browsers. Same way for side-loading apps to your phone. Sure it’s more difficult than just tapping something on the web, but it doesn’t mean it’s safe for the end user.
  - Larrikin 6y ago
    Please don't use the term all browsers when referring to Chrome. A situation like Ad Nauseum and Chrome would never arise on Firefox.

flattone 6y ago

How about urgent app security update email from Customerprotection@Yourbank.com Probably even my tech/developer etc friends some might click that update.

outime 6y ago

Who'd input the credit card on a random website that has suspicious discounts? Who'd give his SSN through the phone to someone saying the bank is calling to verify some details? Who'd believe an email saying that it's the bank and you need to update your app ASAP by clicking on this link or you'll lose access to your account? They (or we) are not stupid, they just don't know better and we should try to shield them from these risks as much as possible.

wonderlg 6y ago

Look up “boa login”, tap ad, YOUR PHONE HAS A VIRUS, tap to install. Suddenly you have a bank app on your phone. You’re welcome. This happens more often than you’d think. It’s even easier when you get targeted attacks via sms saying approximately the same thing. People don’t look at the URL bar.

dheera 6y ago

The user might have downloaded an APK from a phishing website, or received an APK by e-mail claiming to be from their bank.

grawprog 6y ago

>I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from. I'm guessing the people that believe the hax0rs.rus version believes something like, 'get extra money on each deposit with our hacked version' or 'don't like bank fees?? Try the hax0rs.rus version to avoid those pesky bank fees'. But more realistically, I imagine it's people clicking fraudulent links disguised as legitimate looking things from their bank. As apparent as things like that may seem to people who understand the web, it's not always obvious to people who haven't spent a million hours on the internet. Most people eventually learn to pick up a sense about what's legit and not on the web, but it really does take a long time. I'm sure at some point over all your years of computing and interneting you've probably downloaded at least one shady application or clicked one sketchy link by mistake, I know I have, and if you haven't I commend you honestly.