4 ms·

This worries me. Not because of the current usecase - this is already a common practice with cars from used-car dealers (at least in the US). It’s the “what’s n

This worries me. Not because of the current usecase - this is already a common practice with cars from used-car dealers (at least in the US). It’s the “what’s next” usecase, where this is included by default, with other quasi-legal triggers. Some potential triggers: Attempts to root your phone. (For example, via a honeypot root mechanism released by the manufacturer) Using an app store not approved by the manufacturer. Visiting “blacklisted” websites. etc. We might not see these kinds of applications for months or years, but there’s no reason we wouldn’t see them, other than relying on Google’s good will.

13415 6y ago
Common practice? Car dealers in the US can disable used cars remotely?
- petepete 6y ago
  Next step, pacemakers.
- ZekeSulastin 6y ago
  Remote disable systems (and GPS tracking etc!) are mostly seen at/associated with “Buy Here Pay Here” type used car dealerships that target buyers with poor credit. It probably wasn’t much of a stretch for tracker manufacturers who already produced devices for fleet vehicles. https://passtimegps.com/industries/bhph/ https://passtimegps.com/industries/bhph/ and so on.
anuila 6y ago
Google and Apple already have the power to remove apps from your phone, I don’t doubt they could do everything else, should they want to. Additionally, what this app does has definitely been possible forever through device management certificates; this is just an application of it.
wmf 6y ago
Play Services already calculates some kind of security score for the phone based on whether it is rooted etc. and banking apps have access to that API.
- kdrag0n 6y ago
  Fortunately, this is not a readily accessible "score" to all apps and is (currently) only used by select apps as a boolean "passing SafetyNet" check. But Google has been starting to take it seriously recently unlike before by using hardware attestation in TrustZone, so it's been a cat-and-mouse chase to find ways to fool it. It's gotten quite ugly, especially for older phones that are no longer supported by the manufacturer — I'm currently appending an invisible character to the phone model name and faking an old security patch level to pass it. As soon as they decide to enforce hardware attestation for all devices, it's over.

13415 6y ago

Common practice? Car dealers in the US can disable used cars remotely?

petepete 6y ago
Next step, pacemakers.
ZekeSulastin 6y ago
Remote disable systems (and GPS tracking etc!) are mostly seen at/associated with “Buy Here Pay Here” type used car dealerships that target buyers with poor credit. It probably wasn’t much of a stretch for tracker manufacturers who already produced devices for fleet vehicles. https://passtimegps.com/industries/bhph/ https://passtimegps.com/industries/bhph/ and so on.

anuila 6y ago

Google and Apple already have the power to remove apps from your phone, I don’t doubt they could do everything else, should they want to. Additionally, what this app does has definitely been possible forever through device management certificates; this is just an application of it.

wmf 6y ago

Play Services already calculates some kind of security score for the phone based on whether it is rooted etc. and banking apps have access to that API.

kdrag0n 6y ago
Fortunately, this is not a readily accessible "score" to all apps and is (currently) only used by select apps as a boolean "passing SafetyNet" check. But Google has been starting to take it seriously recently unlike before by using hardware attestation in TrustZone, so it's been a cat-and-mouse chase to find ways to fool it. It's gotten quite ugly, especially for older phones that are no longer supported by the manufacturer — I'm currently appending an invisible character to the phone model name and faking an old security patch level to pass it. As soon as they decide to enforce hardware attestation for all devices, it's over.