3 ms·

> I already use Linux with my bank and when I'm interacting with my government. I also use Linux with my bank. All banks I know of in my country require you to

by cesarb 6y ago

> I already use Linux with my bank and when I'm interacting with my government. I also use Linux with my bank. All banks I know of in my country require you to install an invasive "security software" (warsaw), even when you're using the web browser; some also require the phone app to be used as a second factor (for instance, one bank generates a dynamically changing QR code after you enter your password; you have to open its phone app and scan that QR code, which the phone app uses to generate a number to be typed below the QR code). For the government, it's easier, you just have to install the ICP-Brasil root certificates (since they haven't been accepted yet by Mozilla).

danShumway 6y ago
That's terrifying, and I deeply sympathize, but it seems like a government problem more than an app ecosystem or market problem? It's not just that Linux isn't going to break the app store duopoly in your case, nobody is going to, because your government is effectively reinforcing that behavior. Forcing people to install root certificates on their devices is a problem on a whole 'nother level over just commercial incentives. I just don't see how any technology or market-based solution will solve that problem. What happens when the government starts deciding that its authentication software won't work on rooted devices? What happens when the bank decides they need contact/GPS/camera permissions on your phone for "security"? I mean, that's not an app ecosystem problem at that point, it's just full-fledged required malware from your bank. In the US (for all of the many, many faults with our trash-dump of a banking/federal ecosystem) at most I've only ever been asked to do 2FA using completely open standards, and the worst problem I've run into is that my bank's website won't load over some VPNs. I can even disable analytics on my bank's website and it'll still work. But getting support on a Linux phone OS for what sounds to me at first blush like malware and spyware isn't really the best solution to what you're describing. The problem isn't that the malware isn't available on Linux, it's that you're forced to install malware on any of your computers, including iOS/Android.
- cesarb 6y ago
  I think you mixed two different things; what requires the authentication software is the banks, not the government. The government isn't forcing anyone to install the ICP-Brasil root certificates; if you don't, the government websites will just show as untrusted in the browser (since they're signed by one of the CAs which chain to the ICP-Brasil root), but other than that they should work the same. Things might be different if you are authenticating your identity to the government with a certificate stored on a smartcard or USB key, since these certificates are also signed by a CA which chains to the ICP-Brasil root; I don't know if adding the ICP-Brasil root to the browser is necessary to make that work. As for the banks, AFAIK the government doesn't mandate how they approach their online banking security; their use of that invasive "security software" is probably mostly path dependence at this point. It was very common to see computers infected with malware designed to steal online banking credentials from the browser, and that "security software" was supposed to block that kind of malware (for instance, by blocking the browser accessibility APIs whenever the user goes to an online banking site). Things are already better than in the past (that "security software" used to be Windows-only, for instance, so Linux users couldn't use online banking). And yeah, all the bank apps I have on my phone require contact/location/camera permissions (the camera permission is unavoidable since they have to be able to read the QR code for PIX payments, and boleto bancário barcodes), and for at least one of these apps, I strongly suspect it's using the location permission for security purposes (the location indicator always lights up whenever I log into that app). It wouldn't surprise me at all if it also rejected rooted devices.
  - mpol 6y ago
    Here in the Netherlands I can use the website of my bank even if I don't have a smartphone. I get some QR-camera reader which I can point at the computer screen and it generates a TAN code, which I can enter at login and at transactions.. I do believe the government and banks in my country somewhat think in line with the user needs. Not in every country will this mentality exist. Sure, if you want an app for an open source platform like Linux, that may take a lot longer. I think there is already a common platform for this, but not many banks offer it.
  - danShumway 6y ago
    It's a good point, but still not something that I think that can be solved by opening up app stores. My issue isn't that those apps aren't available for Linux. Even if they were available for Linux I wouldn't install a bank app with those permissions. I wouldn't install that on my primary Android phone (I guess there's a good likelyhood I couldn't, since I run rooted Android). I'm not sure what I would do in that position. Maybe get a separate phone just for banking? I don't know, it's really tough. I sympathize. But yeah, the Pinephone is not going to solve that problem, banks would need to move over to open standards for authentication through apps that are trustworthy. Just releasing their apps for a smartphone wouldn't be enough. At least any "security software" that can run on desktop Linux can also be run on your phone, assuming it doesn't freak out over the hardware, and assuming you're willing to tolerate it.
def_true_false 6y ago
> All banks I know of in my country require you to install an invasive "security software" Is this meant to be taken literally? I would be surprised if e.g. mBank didn't work with SMS as the sole enabled 2FA. Personally, I would rather have an extra Android phone for cases like this, as well as for the times when one has to make an actual phone call, though. I wouldn't expect the call quality on the pinephone to be anything to write home about, even if the software was all mature already.

by cesarb 6y ago

danShumway 6y ago

That's terrifying, and I deeply sympathize, but it seems like a government problem more than an app ecosystem or market problem? It's not just that Linux isn't going to break the app store duopoly in your case, nobody is going to, because your government is effectively reinforcing that behavior. Forcing people to install root certificates on their devices is a problem on a whole 'nother level over just commercial incentives. I just don't see how any technology or market-based solution will solve that problem. What happens when the government starts deciding that its authentication software won't work on rooted devices? What happens when the bank decides they need contact/GPS/camera permissions on your phone for "security"? I mean, that's not an app ecosystem problem at that point, it's just full-fledged required malware from your bank. In the US (for all of the many, many faults with our trash-dump of a banking/federal ecosystem) at most I've only ever been asked to do 2FA using completely open standards, and the worst problem I've run into is that my bank's website won't load over some VPNs. I can even disable analytics on my bank's website and it'll still work. But getting support on a Linux phone OS for what sounds to me at first blush like malware and spyware isn't really the best solution to what you're describing. The problem isn't that the malware isn't available on Linux, it's that you're forced to install malware on any of your computers, including iOS/Android.

cesarb 6y ago
I think you mixed two different things; what requires the authentication software is the banks, not the government. The government isn't forcing anyone to install the ICP-Brasil root certificates; if you don't, the government websites will just show as untrusted in the browser (since they're signed by one of the CAs which chain to the ICP-Brasil root), but other than that they should work the same. Things might be different if you are authenticating your identity to the government with a certificate stored on a smartcard or USB key, since these certificates are also signed by a CA which chains to the ICP-Brasil root; I don't know if adding the ICP-Brasil root to the browser is necessary to make that work. As for the banks, AFAIK the government doesn't mandate how they approach their online banking security; their use of that invasive "security software" is probably mostly path dependence at this point. It was very common to see computers infected with malware designed to steal online banking credentials from the browser, and that "security software" was supposed to block that kind of malware (for instance, by blocking the browser accessibility APIs whenever the user goes to an online banking site). Things are already better than in the past (that "security software" used to be Windows-only, for instance, so Linux users couldn't use online banking). And yeah, all the bank apps I have on my phone require contact/location/camera permissions (the camera permission is unavoidable since they have to be able to read the QR code for PIX payments, and boleto bancário barcodes), and for at least one of these apps, I strongly suspect it's using the location permission for security purposes (the location indicator always lights up whenever I log into that app). It wouldn't surprise me at all if it also rejected rooted devices.
- mpol 6y ago
  Here in the Netherlands I can use the website of my bank even if I don't have a smartphone. I get some QR-camera reader which I can point at the computer screen and it generates a TAN code, which I can enter at login and at transactions.. I do believe the government and banks in my country somewhat think in line with the user needs. Not in every country will this mentality exist. Sure, if you want an app for an open source platform like Linux, that may take a lot longer. I think there is already a common platform for this, but not many banks offer it.
- danShumway 6y ago
  It's a good point, but still not something that I think that can be solved by opening up app stores. My issue isn't that those apps aren't available for Linux. Even if they were available for Linux I wouldn't install a bank app with those permissions. I wouldn't install that on my primary Android phone (I guess there's a good likelyhood I couldn't, since I run rooted Android). I'm not sure what I would do in that position. Maybe get a separate phone just for banking? I don't know, it's really tough. I sympathize. But yeah, the Pinephone is not going to solve that problem, banks would need to move over to open standards for authentication through apps that are trustworthy. Just releasing their apps for a smartphone wouldn't be enough. At least any "security software" that can run on desktop Linux can also be run on your phone, assuming it doesn't freak out over the hardware, and assuming you're willing to tolerate it.

def_true_false 6y ago

> All banks I know of in my country require you to install an invasive "security software" Is this meant to be taken literally? I would be surprised if e.g. mBank didn't work with SMS as the sole enabled 2FA. Personally, I would rather have an extra Android phone for cases like this, as well as for the times when one has to make an actual phone call, though. I wouldn't expect the call quality on the pinephone to be anything to write home about, even if the software was all mature already.