6 ms·
Banking has to be the dumbest "security" industry there is. Restrict apps, but can still log in via browser. I have one bank app that actually says to screens
by beerandt 5y ago
Banking has to be the dumbest "security" industry there is.
Restrict apps, but can still log in via browser.
I have one bank app that actually says to screenshot a payment screen for your records, while blocking screenshots via app policy.
- TazeTSchnitzel 5y ago> Restrict apps, but can still log in via browser. This isn't paradoxical. You treat the browser as a less trusted security domain than a phone, which usually has a secure boot chain, strong sandboxing, encrypted disk, reliable hardware cryptography etc, and therefore provide a different/better service on the phone. If a phone is missing one of these expected components then you're not the target market for the app, I guess. (Of course, your phone OS might be perfectly good, and the stock one might be crap, but the app developers don't care.)
- tyingq 5y agoThey allow browsers with, for example, extensions that can spy on a banking interaction with very little effort.
- beerandt 5y agoWhat can a phone OS do to an app that a modern browser can't do to a webpage, as it relates to being a frontend to your bank account?
- lmz 5y agoIf the bank is planning to use the app to replace their hardware 2FA tokens (that they used to mandate for web transactions here), then the app must be considered more secure than the browser (probably because the secrets can be placed somewhere not trivially readable).
- alias_neo 5y agoI disagree. My main bank allows several high-risk actions to be performed when logged in from a web browser, which are entirely impossible from the mobile banking app. It's completely ridiculous that I can't use my mobile banking app for day to day low risk, low volume transactions if my phone is rooted, yet I can do anything and everything with high values of cash and credit from a Linux machine running any web browser I wish, as root. The reality is, the mobile app development is outsourced to incompetent teams for presumably the lowest price who "ensure security" by just saying, "lets chuck a library in that prevents running if the device is detected as being rooted, and call it a day". These are protections any reasonably technical user can circumvent with the likes of Magisk and still, all to do far, far less damage than is possible than if they were to use a web browser.
- asdfaoeu 5y ago> yet I can do anything and everything with high values of cash and credit from a Linux machine running any web browser I wish, as root. Don't give them any ideas. They'll just ban Linux browsers now.
- altfredd 5y ago> The reality is, the mobile app development is outsourced to incompetent teams for presumably the lowest price who "ensure security" by just saying, "lets chuck a library in that prevents running if the device is detected as being rooted, and call it a day". I don't understand, why people think so. Banks hire good developers. They don't pay them well (by banks' own standards), but they still pay enough to hire competent programmers. Unfortunately, working in bank is highly competitive environment, that fosters sycophants and rewards socially adept people, good at obeying orders to letter. Who cares, what the programmers think, they are at the bottom of command chain anyway. The fraud prevention is often split into it's own department. As for "computer security" department, it is a fang-less security circus, that exists to satisfy PCI DSS. In some banks it outright pretends, that web sites and mobile apps don't exist. All your data will be processed in "secure server enclave", managed by "certified professionals", while sending hashes of credit card numbers to Google Analytics.
- MisterTea 5y agoThat's what happens when you have external security requirements along with audits and incompetent/greedy management. Designing and implementing a security policy based on the standard is a waste of money when you can do the bare minimum by checking off boxes.
- concinds 5y agoBank websites in some (developed, European) countries restrict you to 6-8 digit passwords (not alphanumeric), and don't have a 2FA option like Facebook or Google do. It's a massive joke.
- munk-a 5y agoGranted that is on a phone where you can usually just swipe left to their email application and run through some forgot your password steps - also the 2FA that most people use is just SMS which goes to the same place. Assume that if someone has your unlocked phone they own your life.
- mkr-hn 5y agoThe concern with SMS is SIM cloning. An aspiring code thief doesn't need your phone once they can pretend to be your phone.
- hnick 5y agoMany must also store them in plaintext as well, or something like it, because the operator has to be able to confirm the spoken password for telebanking.
- ridaj 5y agoOh and it changes every 6 months "for security reasons" thus guaranteeing it's either very simple or you write it down!
- kblev 5y agoMy favourite was when I needed to enter the second and fifth caracter of my password, and seventh and ninth digit from the login number. These are surely hashed in the database! (Metro Bank UK) not banking with them anymore.
- Glyptodon 5y agoNot to mention the widespread SMS two factor.
- blacksmith_tb 5y agoTotally agree, on my stock Pixel 4a using NextDNS breaks my banking apps (presumably because they're using analytics that get blocked, sigh).
- xvilka 5y agoBanking apps are often the worst from the speed and user experience perspective as well. It's like they hire worst developers to work for them.
- intricatedetail 5y agoBanking is known for skimping on IT staff, hiring cheapest possible workers from 3rd world countries and essentially running sweatshops.