5 ms·

One of the reasons I am not switching to an "alternative" platform like librem or pinephone is that I need apps for things like banking, which are available for

One of the reasons I am not switching to an "alternative" platform like librem or pinephone is that I need apps for things like banking, which are available for iOS and android only. With a working android emulation I could switch from android much easier.

INTPenis 6y ago
Don't the app stores require a safe bootloader? And the banking apps in turn require a working app store. I believe that's how they keep it secure, everything stops working if Google detects you've cracked your bootloader somehow. Disclaimer; I'm using layperson's terms. But I've re-installed a few Pixel phones with Lineage.
- franga2000 6y ago
  If you manage to get a device ID, which wasn't too difficult last time I checked, you can install all the Google crap you want, including the Play store. Rare banking apps will work without any Google crap, most will require Google Play Services (microG works sometimes too), so even without a store, you can just get the APK from wherever and you're good. Modification detection can be handled with Magisk Hide, root detection with RootCloak, custom XPosed modules for the sneakier ones. Occasionally you will see apps using obfuscated native binaries to do advanced detection, but those are rare enough that you can just switch banks.
  - swiley 6y ago
    >get the APK from wherever What an improvement over https. I'm glad the android sandbox has given us so much security.
    - franga2000 6y ago
      I'm not sure what you mean by that. You can get the APK directly from the Play store with some clever trickery (see the Evozi downloader), but even downloading it from any of the dozen or so mirror sites is secure, if that's your concern, because APKs are signed with the developer's key. The reason I said "from wherever" is that sharing APKs G Play is a legal grey area and I didn't want to mention one specific way of getting them because there are many, all with different pros and cons.
      - panpanna 6y ago
        For apps that really need security, android porivdes attestation using secure element. https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation So it's not all wild west. But most apps don't need this level of security.
  - Mindwipe 6y ago
    > Modification detection can be handled with Magisk Hide, root detection with RootCloak, custom XPosed modules for the sneakier ones. Not really, if they're not using hardware attestation for Safetynet they will do soon. And even the developer for Magisk believes there's no practical way around that. https://www.xda-developers.com/safetynet-hardware-attestation-hide-root-magisk/ https://www.xda-developers.com/safetynet-hardware-attestatio...
    - franga2000 6y ago
      Thankfully that hasn't rolled out everywhere yet, and most banking apps I've used rely on less sophisticated methods of tamper detection (like RootBeer). Hopefully Orange Man's little trade war slows down adoption by devs somewhat, but once that fizzles out, we might have to start looking at a regulatory angle. I don't like that idea, but what other choice do we have? Google clearly doesn't listen to their customers (or rather, we aren't their customers) and good luck even getting in touch with a bank's dev team, let alone convince them to do something that, to their uneducated higher-ups at least, looks like a security downgrade.
- panpanna 6y ago
  The store does, but not all apps require it and can be sideloaded. Assume banking apps do tho
- blendergeek 6y ago
  Some apps require a locked bootloader to run. Others just require a locked bootloader to download from the Playstore. There are other ways of obtaining the APKs outside the playstore, however. My banking app isn't supposed to work if the phone is rooted, but it rarely gives me trouble.
swiley 6y ago
I've heard this a couple of times and it seems a bit strange. My bank is entirely online and has a very nice app (USAA) but there's absolutely nothing that can be done in the app and can't be done with their webpage. Is this something that happens often in eg Europe?
- williamdclt 6y ago
  There's more examples, but the main feature I'd lose is contactless pay with my phone. Which I could live without, but it's such a nice feature that I use multiple times a day that I'm not sure what it would take to get me to give it up. I think that the US doesn't use mobile payment a lot, so it might not be obvious (if you're in the US, that is)
- pmontra 6y ago
  There is a European banking regulation mandating 2FA. Apps are starting to be mandatory because they generate the OTP or authorize access: start logging in in the browser on the computer and authorize the access with a fingerprint in the app. https://en.wikipedia.org/wiki/Strong_customer_authentication https://en.wikipedia.org/wiki/Strong_customer_authentication
  - panpanna 6y ago
    I would say the authentication app is becoming mandatory, not the banking apps. It is perfectly possible to use the website but authorize with the app. Which I admit does not solve the problem at hand
    - pmontra 6y ago
      This is what I usually do: login on the computer and authorize on the app with a fingerprint or a PIN. It depends on the bank and doesn't require signin in into the home banking, only opening the app. The access to home banking in the app is always by fingerprint.
  - srtjstjsj 6y ago
    If the app is on the same device as the OTP, that's not really 2FA, since the device has both factors on it, making the device 1 factor. Maybe 1.5 factor since there are ways to steal a password without getting access to the device. Anyway the computer or a dongle can be the OTP device just as well as the phone can.

INTPenis 6y ago

Don't the app stores require a safe bootloader? And the banking apps in turn require a working app store. I believe that's how they keep it secure, everything stops working if Google detects you've cracked your bootloader somehow. Disclaimer; I'm using layperson's terms. But I've re-installed a few Pixel phones with Lineage.

franga2000 6y ago
If you manage to get a device ID, which wasn't too difficult last time I checked, you can install all the Google crap you want, including the Play store. Rare banking apps will work without any Google crap, most will require Google Play Services (microG works sometimes too), so even without a store, you can just get the APK from wherever and you're good. Modification detection can be handled with Magisk Hide, root detection with RootCloak, custom XPosed modules for the sneakier ones. Occasionally you will see apps using obfuscated native binaries to do advanced detection, but those are rare enough that you can just switch banks.
- swiley 6y ago
  >get the APK from wherever What an improvement over https. I'm glad the android sandbox has given us so much security.
  - franga2000 6y ago
    I'm not sure what you mean by that. You can get the APK directly from the Play store with some clever trickery (see the Evozi downloader), but even downloading it from any of the dozen or so mirror sites is secure, if that's your concern, because APKs are signed with the developer's key. The reason I said "from wherever" is that sharing APKs G Play is a legal grey area and I didn't want to mention one specific way of getting them because there are many, all with different pros and cons.
    - panpanna 6y ago
      For apps that really need security, android porivdes attestation using secure element. https://developer.android.com/training/safetynet/attestation https://developer.android.com/training/safetynet/attestation https://source.android.com/security/keystore/attestation https://source.android.com/security/keystore/attestation So it's not all wild west. But most apps don't need this level of security.
- Mindwipe 6y ago
  > Modification detection can be handled with Magisk Hide, root detection with RootCloak, custom XPosed modules for the sneakier ones. Not really, if they're not using hardware attestation for Safetynet they will do soon. And even the developer for Magisk believes there's no practical way around that. https://www.xda-developers.com/safetynet-hardware-attestation-hide-root-magisk/ https://www.xda-developers.com/safetynet-hardware-attestatio...
  - franga2000 6y ago
    Thankfully that hasn't rolled out everywhere yet, and most banking apps I've used rely on less sophisticated methods of tamper detection (like RootBeer). Hopefully Orange Man's little trade war slows down adoption by devs somewhat, but once that fizzles out, we might have to start looking at a regulatory angle. I don't like that idea, but what other choice do we have? Google clearly doesn't listen to their customers (or rather, we aren't their customers) and good luck even getting in touch with a bank's dev team, let alone convince them to do something that, to their uneducated higher-ups at least, looks like a security downgrade.
panpanna 6y ago
The store does, but not all apps require it and can be sideloaded. Assume banking apps do tho
blendergeek 6y ago
Some apps require a locked bootloader to run. Others just require a locked bootloader to download from the Playstore. There are other ways of obtaining the APKs outside the playstore, however. My banking app isn't supposed to work if the phone is rooted, but it rarely gives me trouble.

swiley 6y ago

I've heard this a couple of times and it seems a bit strange. My bank is entirely online and has a very nice app (USAA) but there's absolutely nothing that can be done in the app and can't be done with their webpage. Is this something that happens often in eg Europe?

williamdclt 6y ago
There's more examples, but the main feature I'd lose is contactless pay with my phone. Which I could live without, but it's such a nice feature that I use multiple times a day that I'm not sure what it would take to get me to give it up. I think that the US doesn't use mobile payment a lot, so it might not be obvious (if you're in the US, that is)
pmontra 6y ago
There is a European banking regulation mandating 2FA. Apps are starting to be mandatory because they generate the OTP or authorize access: start logging in in the browser on the computer and authorize the access with a fingerprint in the app. https://en.wikipedia.org/wiki/Strong_customer_authentication https://en.wikipedia.org/wiki/Strong_customer_authentication
- panpanna 6y ago
  I would say the authentication app is becoming mandatory, not the banking apps. It is perfectly possible to use the website but authorize with the app. Which I admit does not solve the problem at hand
  - pmontra 6y ago
    This is what I usually do: login on the computer and authorize on the app with a fingerprint or a PIN. It depends on the bank and doesn't require signin in into the home banking, only opening the app. The access to home banking in the app is always by fingerprint.
- srtjstjsj 6y ago
  If the app is on the same device as the OTP, that's not really 2FA, since the device has both factors on it, making the device 1 factor. Maybe 1.5 factor since there are ways to steal a password without getting access to the device. Anyway the computer or a dongle can be the OTP device just as well as the phone can.