3 ms·

By and large this is true. However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront

by vczf 6y ago

By and large this is true. However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. I don't think Apple would allow that kind of permissions abuse, but apparently Google does.

DaiPlusPlus 6y ago
> However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users. I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, but still idiotic. This is the same Citibank that’s been engaged in an idiotic arms-race with Google about blocking password-safes on their online banking login page for the past 5+ years - while also allowing me to do phone-banking without any real authentication - and STILL haven’t given me an EMV Chip+PIN credit-card, while the EMV Chip+Sign card I do have from them DOES have NFC without a purchase limit... anyone could steal my wallet and “tap” a couple grand off it. Arggghhhhhh. The “banks who think they’re smarter about security than platform vendors” trope is getting real old.
- callalex 6y ago
  No, it’s because they like laundering money and the profit that brings, and hate any feature that might prove their wrongdoing empirically. https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET25A https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET...
  - DaiPlusPlus 6y ago
    Oh, of course - I understand most (if not all?) major banks have serious ethics issues from the top-down - but money-laundering is a business-objective and is distinct and separate from online banking security. The $70m fine (a joke to a multi-billion-dollar company) is insignificant to the potential damages from a class-action lawsuit from a wide-ranging vulnerability in their online banking platform - hence their focus and over-engineering on their online banking security - while the risks from credit-card abuse and individual identity-theft are much more limited in scope - and are a known-quantity.
- squeaky-clean 6y ago
  To the consumer it doesn't really matter if it's malice or ineptitude or laziness. Fact is Apple will remove your app if you try something like that, but it is not uncommon to encounter this on Android.

by vczf 6y ago

DaiPlusPlus 6y ago

> However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront. Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users. I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, but still idiotic. This is the same Citibank that’s been engaged in an idiotic arms-race with Google about blocking password-safes on their online banking login page for the past 5+ years - while also allowing me to do phone-banking without any real authentication - and STILL haven’t given me an EMV Chip+PIN credit-card, while the EMV Chip+Sign card I do have from them DOES have NFC without a purchase limit... anyone could steal my wallet and “tap” a couple grand off it. Arggghhhhhh. The “banks who think they’re smarter about security than platform vendors” trope is getting real old.

callalex 6y ago
No, it’s because they like laundering money and the profit that brings, and hate any feature that might prove their wrongdoing empirically. https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET25A https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET...
- DaiPlusPlus 6y ago
  Oh, of course - I understand most (if not all?) major banks have serious ethics issues from the top-down - but money-laundering is a business-objective and is distinct and separate from online banking security. The $70m fine (a joke to a multi-billion-dollar company) is insignificant to the potential damages from a class-action lawsuit from a wide-ranging vulnerability in their online banking platform - hence their focus and over-engineering on their online banking security - while the risks from credit-card abuse and individual identity-theft are much more limited in scope - and are a known-quantity.
squeaky-clean 6y ago
To the consumer it doesn't really matter if it's malice or ineptitude or laziness. Fact is Apple will remove your app if you try something like that, but it is not uncommon to encounter this on Android.