4 ms·

Custom Android ROMs exist for you and me. Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their compl

by Arnt 4y ago

Custom Android ROMs exist for you and me. Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. If a smartphone vendor wants to give a wide audience access to apps and the net, then the vendor has to cater to people like that neighbour. And that, in turn, means that it must be very, very, very difficult to social-engineer that neighbour into granting another app access to the data in the banking app. To my mind, protecting most people's savings is much more important than catering to people like you and me. You may disagree.

cowtools 4y ago
>Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users? I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.
- Arnt 4y ago
  Your guess is wrong. It was a two-step attack that relied on social engineering and misleading. They had scammed about fifty people in Munich by the time it was in the papers, and my guess is that a substantial number of ordinary adults here would fall for it. Personally, I consider it quite reasonable if our OSes are set up to make it difficult to scam regular people, even at the cost of making my tinkering difficult. It's the sensible default, IMO. Feel free to disagree, or even to downvote me. (I'm sure some of the fifty-odd people used apps to pay the criminals, but that wasn't relevant to the way the scam worked.)
  - josephcsible 4y ago
    What changes to the OS would have prevented the kind of scam you're talking about?
car_analogy 4y ago
"Protecting most people's savings" quickly becomes "90% of the population only has access to officially sanctioned apps and websites". Not good if you want a free society. But since you haven't offered any details of the social engineering attack, I'm going to assume there's a freedom-respecting way to prevent it that you're ignorant of, just as you were ignorant of how random people may be prevented root access to non-manufacturer-controlled devices by something as common and trivial as default, buyer-changeable passwords.
josephcsible 4y ago
Did the social engineering involve root access to a phone, or was it more along the lines of just tricking the victim into doing a bank transfer? And should we take away root access from desktop computers too by the same logic?

by Arnt 4y ago

cowtools 4y ago

>Someone who lives across the backyard from me was social-engineered out of several months' salary. Almost their complete savings. It was a nasty story, and no, the money hasn't been returned. Let me guess, bank transfers? Maybe we should think about improving banking security and informing users before we try locking down nearly every piece of consumer electronics on the market. There is no need for these "banking apps" to exist in the first place. What happened to online banking over the web? Where is the accountability of these banks here? Where is the personal accountability from these users? I really don't buy this argument. If you can't practice basic security and due diligence, you shouldn't have an online banking account, let alone a computer, you should be in a nursing home.

Arnt 4y ago
Your guess is wrong. It was a two-step attack that relied on social engineering and misleading. They had scammed about fifty people in Munich by the time it was in the papers, and my guess is that a substantial number of ordinary adults here would fall for it. Personally, I consider it quite reasonable if our OSes are set up to make it difficult to scam regular people, even at the cost of making my tinkering difficult. It's the sensible default, IMO. Feel free to disagree, or even to downvote me. (I'm sure some of the fifty-odd people used apps to pay the criminals, but that wasn't relevant to the way the scam worked.)
- josephcsible 4y ago
  What changes to the OS would have prevented the kind of scam you're talking about?

car_analogy 4y ago

"Protecting most people's savings" quickly becomes "90% of the population only has access to officially sanctioned apps and websites". Not good if you want a free society. But since you haven't offered any details of the social engineering attack, I'm going to assume there's a freedom-respecting way to prevent it that you're ignorant of, just as you were ignorant of how random people may be prevented root access to non-manufacturer-controlled devices by something as common and trivial as default, buyer-changeable passwords.

josephcsible 4y ago

Did the social engineering involve root access to a phone, or was it more along the lines of just tricking the victim into doing a bank transfer? And should we take away root access from desktop computers too by the same logic?