5 ms·

Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a

Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Apple vs Android is irrelevant in this, there is no truly safe mainstream phone in 2022, period. Are people really that lazy? I do manage quite a few financial things but for none of those phone apps is crucial and I use exactly 0 of them. There is ebanking login app, but on its own its useless, another 3 factors are required for login. There is always desktop browser variant for everything, with firefox with ublock origin and few other plugins making internet a bit more as it was intended to be. So yes US government can hack my phone if they havent already, they will see what kind of photography and travelling I do, which family members I write to, and some online shopping history. Thats it. Phones are not secure and probably never will be for anything more. Anybody telling you otherwise is either dangerously clueless or worse

jjcm 4y ago
Because accounts are insured and so need to transfer money on the go. How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. How do you withdraw money from an ATM? Again, this is moving primarily app based. Your definition of sane may be security at all costs, but for most convenience and social norms trump this.
- sweetbitter 4y ago
  > How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. With cash? > How do you withdraw money from an ATM? Again, this is moving primarily app based. With a card?
kelnos 4y ago
> Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Because it's convenient, and security is a trade off with convenience. I use banking apps on my phone, and I suspect many (most, even) people here on HN (and who are technically savvy in general) do as well. That doesn't make it smart or good or correct, but I suspect that is the status quo. I haven't traveled outside the US since before the pandemic, but these days I may only travel with a burner phone the next time I do so. > Phones are not secure Neither are laptops or desktops, or anything, really. Everyone needs to decide for themselves what level of security they're willing to accept, and what their threat model is.
- tremon 4y ago
  Neither are laptops or desktops Perhaps, but at least I know how to audit a laptop or desktop. How would you audit iOS or Android?
jlokier 4y ago
> ever put such a critical item as banking app on their phone? Laziness has nothing to do with it. Why? Three of my bank accounts cannot be accessed without a phone app, and some of my credit cards will not authorise payments without a phone app. It's not a choice. Two of the bank accounts do have web banking too, i.e. from a desktop browser. But you have to use the phone app to authenticate the browser login! I found this out the hard way, when my phone screen died so I couldn't login to web banking on my laptop. I called customer support, hoping to use phone banking to make some payments. They told me they could not do anything until I obtained a new working phone, moved my SIM or phone number over, and then they could transfer the authentication to the new device. Other than that, they had no options for logging in. It was fine to borrow someone else's phone if I wanted, installing the bank app on there, but I couldn't login without a phone. I had to go through this again when the second phone died a few months later. Now, I'm guessing you're thinking "use a different bank, duh!". Turns out I didn't have a choice of non-app banks when I needed to open a business account during the pandemic, in order to accept a contract, which I needed. My credit rating was not rosy either, greatly limiting which card services I could choose. Things are easier now, thanks.
- BLKNSLVR 4y ago
  Some banks certainly don't help themselves when it comes to security practises they foist on their customers. My bank supports 2FA, but only via SMS...
  - brewdad 4y ago
    My bank sent me a little fob that generates a one time code. Of course, they will also use SMS, the app on your phone, or email for 2FA. They are all considered equally valid and there is no intermediate step should you wish to use one over the other at any time. So really the fob is theater.
BLKNSLVR 4y ago
100% agree. Wth the various stories about what data apps seem able to access despite being totally unrelated to their core function, they appear to be a goldmine for privacy invaders (advertising companies) and scammers, hence why even semi-popular apps are targeted for purchase by unethicals to turn into personal data feeds. I don't have banking apps on my phone. I don't need to move money immediately in any situation. And I still have more apps on my phone than I'm comfortable with. It's all a personal choice about risk appetite, but for most people (not really the HN crowd) the risks are downplayed or unknown.
vkou 4y ago
>ever put such a critical item as banking app on their phone? Because my PC isn't meaningfully more secure. Because in the overwhelming majority of situations, if that security is compromised, my bank will eventually cough up my money. Also because I also expect neither Google, Apple, my carrier, nor the dab gum gubment is likely to rob me by... *checks notes* Compromising the banking app on my phone. Or my PC. Or my router. Or any of the other non-100% secure devices and processes I use to get through my life. There's basic security precautions, and there's living in fear and paranoia, brought on by a misunderstanding of the threats you are facing.
- saurik 4y ago
  As someone who works very prominently in mobile device security, and had to long ago come to the realization that I actually KNEW the people who could manage to hack into my phones... I agree with your answer 100%. The threat analysis here leading to only using Firefox on your desktop computer to access your bank makes absolutely no sense to me and--to inject some conspiracy theory back into this (for shits and giggles)--almost feels like "what the enemy wants you to do" ;P.
- xani_ 4y ago
  If your bank uses phone for 2FA (say OTP via SMS or whatever else), but you have no bank login, now attacker have to hack your PC (to get bank account login) AND phone (to get access to 2FA). So not having your 2FA source in same place as your password would be meaningfully more secure
- autoexec 4y ago
  > Compromising the banking app on my phone. Or my PC. Or my router. Or any of the other non-100% secure devices and processes I use to get through my life. There's basic security precautions, and there's living in fear and paranoia, brought on by a misunderstanding of the threats you are facing. If you think the risks to your privacy and security are remotely equivalent with a PC and a cell phone I'd argue that you're the one who is misunderstanding the threats you are facing. It is possible that your PC is no more secure than your phone, but that'd be uncommon and your own failing. You can be responsible and secure a PC pretty well, but there is nothing you can do to prevent a functional cell phone from collecting extremely sensitive data and leaking it like a sieve.
prng2021 4y ago
Do you ever use an ATM? How do you justify the possibility there’s a card skimmer in it? You mentioned “hacks, 0-days and bugs”. I assume you’ve seen the news when big banks like capitalone got hacked. Do you believe your account is safe from any of these types of hacks because you don’t use their mobile app? How do you justify using your phone to communicate with family members? After all, a hacker could use those people as an attack vector. Those communications, the family member email addresses, your photos and travel history and shopping history could all be used to profile you, profile them, steal your identity, etc How do you justify using any technology whatsoever when it’s just such a scary world? Once you answer that for yourself, you’ll find the answer to your “why the hell would anybody sane” question.

jjcm 4y ago

Because accounts are insured and so need to transfer money on the go. How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. How do you withdraw money from an ATM? Again, this is moving primarily app based. Your definition of sane may be security at all costs, but for most convenience and social norms trump this.

sweetbitter 4y ago
> How do you transfer money to friends when you go out to dinner? At least in Australia, this is done via your banking app. With cash? > How do you withdraw money from an ATM? Again, this is moving primarily app based. With a card?

kelnos 4y ago

> Why the hell would anybody sane, especially with all knowledge average HN user has about government overreach and greed, hacks, 0days, bugs etc. ever put such a critical item as banking app on their phone? Because it's convenient, and security is a trade off with convenience. I use banking apps on my phone, and I suspect many (most, even) people here on HN (and who are technically savvy in general) do as well. That doesn't make it smart or good or correct, but I suspect that is the status quo. I haven't traveled outside the US since before the pandemic, but these days I may only travel with a burner phone the next time I do so. > Phones are not secure Neither are laptops or desktops, or anything, really. Everyone needs to decide for themselves what level of security they're willing to accept, and what their threat model is.

tremon 4y ago
Neither are laptops or desktops Perhaps, but at least I know how to audit a laptop or desktop. How would you audit iOS or Android?

jlokier 4y ago

> ever put such a critical item as banking app on their phone? Laziness has nothing to do with it. Why? Three of my bank accounts cannot be accessed without a phone app, and some of my credit cards will not authorise payments without a phone app. It's not a choice. Two of the bank accounts do have web banking too, i.e. from a desktop browser. But you have to use the phone app to authenticate the browser login! I found this out the hard way, when my phone screen died so I couldn't login to web banking on my laptop. I called customer support, hoping to use phone banking to make some payments. They told me they could not do anything until I obtained a new working phone, moved my SIM or phone number over, and then they could transfer the authentication to the new device. Other than that, they had no options for logging in. It was fine to borrow someone else's phone if I wanted, installing the bank app on there, but I couldn't login without a phone. I had to go through this again when the second phone died a few months later. Now, I'm guessing you're thinking "use a different bank, duh!". Turns out I didn't have a choice of non-app banks when I needed to open a business account during the pandemic, in order to accept a contract, which I needed. My credit rating was not rosy either, greatly limiting which card services I could choose. Things are easier now, thanks.

BLKNSLVR 4y ago
Some banks certainly don't help themselves when it comes to security practises they foist on their customers. My bank supports 2FA, but only via SMS...
- brewdad 4y ago
  My bank sent me a little fob that generates a one time code. Of course, they will also use SMS, the app on your phone, or email for 2FA. They are all considered equally valid and there is no intermediate step should you wish to use one over the other at any time. So really the fob is theater.

BLKNSLVR 4y ago

100% agree. Wth the various stories about what data apps seem able to access despite being totally unrelated to their core function, they appear to be a goldmine for privacy invaders (advertising companies) and scammers, hence why even semi-popular apps are targeted for purchase by unethicals to turn into personal data feeds. I don't have banking apps on my phone. I don't need to move money immediately in any situation. And I still have more apps on my phone than I'm comfortable with. It's all a personal choice about risk appetite, but for most people (not really the HN crowd) the risks are downplayed or unknown.

vkou 4y ago

>ever put such a critical item as banking app on their phone? Because my PC isn't meaningfully more secure. Because in the overwhelming majority of situations, if that security is compromised, my bank will eventually cough up my money. Also because I also expect neither Google, Apple, my carrier, nor the dab gum gubment is likely to rob me by... *checks notes* Compromising the banking app on my phone. Or my PC. Or my router. Or any of the other non-100% secure devices and processes I use to get through my life. There's basic security precautions, and there's living in fear and paranoia, brought on by a misunderstanding of the threats you are facing.

saurik 4y ago
As someone who works very prominently in mobile device security, and had to long ago come to the realization that I actually KNEW the people who could manage to hack into my phones... I agree with your answer 100%. The threat analysis here leading to only using Firefox on your desktop computer to access your bank makes absolutely no sense to me and--to inject some conspiracy theory back into this (for shits and giggles)--almost feels like "what the enemy wants you to do" ;P.
xani_ 4y ago
If your bank uses phone for 2FA (say OTP via SMS or whatever else), but you have no bank login, now attacker have to hack your PC (to get bank account login) AND phone (to get access to 2FA). So not having your 2FA source in same place as your password would be meaningfully more secure
autoexec 4y ago
> Compromising the banking app on my phone. Or my PC. Or my router. Or any of the other non-100% secure devices and processes I use to get through my life. There's basic security precautions, and there's living in fear and paranoia, brought on by a misunderstanding of the threats you are facing. If you think the risks to your privacy and security are remotely equivalent with a PC and a cell phone I'd argue that you're the one who is misunderstanding the threats you are facing. It is possible that your PC is no more secure than your phone, but that'd be uncommon and your own failing. You can be responsible and secure a PC pretty well, but there is nothing you can do to prevent a functional cell phone from collecting extremely sensitive data and leaking it like a sieve.

prng2021 4y ago

Do you ever use an ATM? How do you justify the possibility there’s a card skimmer in it? You mentioned “hacks, 0-days and bugs”. I assume you’ve seen the news when big banks like capitalone got hacked. Do you believe your account is safe from any of these types of hacks because you don’t use their mobile app? How do you justify using your phone to communicate with family members? After all, a hacker could use those people as an attack vector. Those communications, the family member email addresses, your photos and travel history and shopping history could all be used to profile you, profile them, steal your identity, etc How do you justify using any technology whatsoever when it’s just such a scary world? Once you answer that for yourself, you’ll find the answer to your “why the hell would anybody sane” question.