4 ms·

People wonder why I don't want to use smartphone apps for, well, almost anything. This. This is why. At least browsing someone's web app using a real browser

People wonder why I don't want to use smartphone apps for, well, almost anything. This. This is why. At least browsing someone's web app using a real browser on a real PC, I know I'm in control of what data they do or (usually) don't have enough access to read. I was looking into some of the new banks in the UK recently, and it is apparently becoming common to not only provide but require the use of their mobile app to identify yourself and set up an account with them. Oh, and by the way, their terms imply that they might also use that app to track a few little details, like your location at all times. Perhaps they just need "to make sure it's really you"? I will enjoy the Schadenfreude if the data protection regulator gets involved... but not as a customer of any bank that tries that!

brailsafe 6y ago
My girlfriend's father, who works at an insurance company, heard I was looking for work while I was over at dinner, and starting talking about one of the hot new technology things they're investing in, which was real-time location monitoring in-app. I tried to be polite—as I am with most people who hear that I do computers or whatever— but he did seem taken aback by my lack of enthusiasm for my insurance company being able to know where I am at all times.
matheusmoreira 6y ago
Banks in Brazil came up with something called a "security module". It's a kernel driver that intercepts all network connections. It makes everything slow and probably leaks highly sensitive private information back to the bank and god knows who else. I had to boot windows in safe mode in order to get rid of this thing. Apparently, malware is perfectly legitimate if it serves the business interests of the rich and powerful.
- the_only_law 6y ago
  Oh god, and I thought anti cheat kernel crap was bad .
  - matheusmoreira 6y ago
    Yeah. At least those only accidentally introduce vulnerabilities into your computer, right? God I hate these anti-cheat software companies... They think they can just own people's computers for the sake of some game. The sheer audacity of it is what pisses me off...
    - nlightcho 6y ago
      I agree with your argument on principle but cheating in multiplayer games is a real problem and for now kernel level anti-cheat is pretty much necessary until better methods are developed like server-side ML detection. For what it's worth anti-cheat software is routinely disassembled by cheat developers so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues (any of which would get immediately exploited by said cheat developers).
      - bigiain 6y ago
        If your game company “pretty much requires” you to install “anti cheat kernel modules” on my machine, unless you’re supplying that machine to me as part of my game purchase price exclusively to play your game with, you can just go broke thanks. Flawed business models do not give you the right to break into and exploit my hardware.
      - Silhouette 6y ago
        There are other ways to attack cheating. Besides, trusting a remote system you don't control is a case study in Security Failures 101. It's about as likely to work in the long term as typical DRM schemes: it does create a barrier, and it will deter casual violation by most people for as long as that barrier holds, but if there's enough incentive then sooner or later someone who knows what they're doing will break the barrier, and then they might share that ability with everyone else anyway.
      - matheusmoreira 6y ago
        So what if it's a problem? Are these game companies entitled to stop cheating by any means necessary? No. It's my computer and game companies have no right to tell me what I can or can't do with it. If I want to cheat at their game, that's my right. The game is running on my computer and I should be able to modify anything I want whenever I want. Cheating at games is just an exercise in computer freedom. It shouldn't be prohibited to begin with as a matter of principle. I actually have little interest in cheating though. What happens often enough is these anti-cheat services will scan my processes, detect my development tools or virtual machines and label me a cheater because of them. Some games literally refuse to even start because of this. They also ensure a lack of Linux compatibility due to their proprietary Windows drivers. > so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues Remember capcom.sys? https://mobile.twitter.com/TheWack0lian/status/779397840762245124/ https://mobile.twitter.com/TheWack0lian/status/7793978407622...
- kls 6y ago
  Back in the day if you played a audio CD from Sony, you got a rootkit for your added enjoyment. To this day I have never bought a Sony product due to that debacle and never will until someone goes to jail for hacking millions of computers. Which pretty much means I will never buy a Sony product again.
  - Silhouette 6y ago
    Don't forget the part where the subsequent software supposedly provided to fix the problems actually made things worse. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... I suspect if they'd tried something like that today, it would have been a much bigger deal in the media and the resulting legal actions would have cost them a lot more. At least the fiasco probably increased awareness of the danger and prompted changes in various computer misuse laws around the world.
- Silhouette 6y ago
  My personal view is that the operating systems we trust to be the foundation of our modern devices simply shouldn't allow that kind of access to most applications. Installing software that genuinely does need some level of privileged access to do its job -- perhaps device drivers, or diagnostic tools for people who work in hardware development and really do need to test low level I/O -- should require a different process from the user's perspective. That process for privileged installation should come with prominent warnings telling the user not to do it unless they're sure you know who's asked them to and why, and perhaps require the user to enter some sort of text confirmation in response to avoid accidental/auto-pilot click-throughs. The need for this kind of installation should be rare enough for normal users, particularly if the OS is designed to run most third party drivers in user space anyway, that this wouldn't be a big deal for usability. Maybe then even banks might think twice about trying to pull that kind of stunt, if they would have to field many calls from concerned customers over the next 48 hours asking whether someone was trying to hack their bank account. Perhaps they'd even make it into the news as a result, and have to explain why their software was triggering security warnings, which could be nicely embarrassing PR too.

brailsafe 6y ago

My girlfriend's father, who works at an insurance company, heard I was looking for work while I was over at dinner, and starting talking about one of the hot new technology things they're investing in, which was real-time location monitoring in-app. I tried to be polite—as I am with most people who hear that I do computers or whatever— but he did seem taken aback by my lack of enthusiasm for my insurance company being able to know where I am at all times.

matheusmoreira 6y ago

Banks in Brazil came up with something called a "security module". It's a kernel driver that intercepts all network connections. It makes everything slow and probably leaks highly sensitive private information back to the bank and god knows who else. I had to boot windows in safe mode in order to get rid of this thing. Apparently, malware is perfectly legitimate if it serves the business interests of the rich and powerful.

the_only_law 6y ago
Oh god, and I thought anti cheat kernel crap was bad .
- matheusmoreira 6y ago
  Yeah. At least those only accidentally introduce vulnerabilities into your computer, right? God I hate these anti-cheat software companies... They think they can just own people's computers for the sake of some game. The sheer audacity of it is what pisses me off...
  - nlightcho 6y ago
    I agree with your argument on principle but cheating in multiplayer games is a real problem and for now kernel level anti-cheat is pretty much necessary until better methods are developed like server-side ML detection. For what it's worth anti-cheat software is routinely disassembled by cheat developers so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues (any of which would get immediately exploited by said cheat developers).
    - bigiain 6y ago
      If your game company “pretty much requires” you to install “anti cheat kernel modules” on my machine, unless you’re supplying that machine to me as part of my game purchase price exclusively to play your game with, you can just go broke thanks. Flawed business models do not give you the right to break into and exploit my hardware.
    - Silhouette 6y ago
      There are other ways to attack cheating. Besides, trusting a remote system you don't control is a case study in Security Failures 101. It's about as likely to work in the long term as typical DRM schemes: it does create a barrier, and it will deter casual violation by most people for as long as that barrier holds, but if there's enough incentive then sooner or later someone who knows what they're doing will break the barrier, and then they might share that ability with everyone else anyway.
    - matheusmoreira 6y ago
      So what if it's a problem? Are these game companies entitled to stop cheating by any means necessary? No. It's my computer and game companies have no right to tell me what I can or can't do with it. If I want to cheat at their game, that's my right. The game is running on my computer and I should be able to modify anything I want whenever I want. Cheating at games is just an exercise in computer freedom. It shouldn't be prohibited to begin with as a matter of principle. I actually have little interest in cheating though. What happens often enough is these anti-cheat services will scan my processes, detect my development tools or virtual machines and label me a cheater because of them. Some games literally refuse to even start because of this. They also ensure a lack of Linux compatibility due to their proprietary Windows drivers. > so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues Remember capcom.sys? https://mobile.twitter.com/TheWack0lian/status/779397840762245124/ https://mobile.twitter.com/TheWack0lian/status/7793978407622...
kls 6y ago
Back in the day if you played a audio CD from Sony, you got a rootkit for your added enjoyment. To this day I have never bought a Sony product due to that debacle and never will until someone goes to jail for hacking millions of computers. Which pretty much means I will never buy a Sony product again.
- Silhouette 6y ago
  Don't forget the part where the subsequent software supposedly provided to fix the problems actually made things worse. https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk... I suspect if they'd tried something like that today, it would have been a much bigger deal in the media and the resulting legal actions would have cost them a lot more. At least the fiasco probably increased awareness of the danger and prompted changes in various computer misuse laws around the world.
Silhouette 6y ago
My personal view is that the operating systems we trust to be the foundation of our modern devices simply shouldn't allow that kind of access to most applications. Installing software that genuinely does need some level of privileged access to do its job -- perhaps device drivers, or diagnostic tools for people who work in hardware development and really do need to test low level I/O -- should require a different process from the user's perspective. That process for privileged installation should come with prominent warnings telling the user not to do it unless they're sure you know who's asked them to and why, and perhaps require the user to enter some sort of text confirmation in response to avoid accidental/auto-pilot click-throughs. The need for this kind of installation should be rare enough for normal users, particularly if the OS is designed to run most third party drivers in user space anyway, that this wouldn't be a big deal for usability. Maybe then even banks might think twice about trying to pull that kind of stunt, if they would have to field many calls from concerned customers over the next 48 hours asking whether someone was trying to hack their bank account. Perhaps they'd even make it into the news as a result, and have to explain why their software was triggering security warnings, which could be nicely embarrassing PR too.