3 ms·

Can't the banks implement some measures so that only their own apps can do transactions?

zacksiri 4y ago
Believe me they’re trying. They’re now mandating biometric authentication, and I don’t mean on device, I mean implemented by the banks app / backend. If you read the articles you’ll see. Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand. We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement. Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure. Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking. It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
- gambiting 4y ago
  Literally nothing that you've said is a good excuse for forbidding sideloading. It would be actually trivial for a bank to only allow transactions from their apps, if they can't do that then they should be forced to take responsibility for fraud. Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result. >>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man. I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
  - JimDabell 4y ago
    > It would be actually trivial for a bank to only allow transactions from their apps How?
    - gambiting 4y ago
      What do you mean how? The app has a secure token only the app has, any traffic without that token is invalid. IOS already sandboxes all apps so the token would be impossible to extract. This is basic app security, I can't believe this is even discussed
      - JimDabell 4y ago
        > The app has a secure token only the app has What kind of token? How does it obtain it?
        xgb84j 4y ago
        This is how I think it roughly works where I live: You get a per-user token directly at the bank or via mail (not email, but a physical envelope). Your banking app can use this token once to get a secret key. Secret key + user name + password allows you to use the banking app. Any way to circumvent this requires app isolation to be broken somehow.
        JimDabell 4y ago
        Sadly, there’s a far more straightforward way. The phisher says “Sorry, your token has expired! You will need to get a new one…” Plenty of people will fall for it. Also, I wouldn’t personally describe an out-of-band token delivery / exchange mechanism like that as “actually trivial” for apps to do.
      - jeroenhd 4y ago
        People extract tokens from apps all the time. Jailbreaks for modern versions of iOS do exist and if they become too hard to pull off, that'll just create a market for pre-jailbroken devices. Tokens embedded into your app can and will be extracted. You can make life harder for criminals by rapidly updating tokens and invalidating all but the last X updates, but I doubt your users are going to like that, and I doubt criminals will be stopped for long with the amount of money at stake. There are ways to make it incredibly difficult for hacked apps but if the file ends up at a user's device, you lose control.
- eastbound 4y ago
  I hate that baks require the phone app, where transactions don’t also require a computer: It enables racket where my aggressor can list my bank accounts; It also reduces the 2FA to 1FA (phone-only transactions with password + fingerprint + SMS only on the phone).

Believe me they’re trying. They’re now mandating biometric authentication, and I don’t mean on device, I mean implemented by the banks app / backend. If you read the articles you’ll see. Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand. We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement. Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure. Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking. It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.

gambiting 4y ago
Literally nothing that you've said is a good excuse for forbidding sideloading. It would be actually trivial for a bank to only allow transactions from their apps, if they can't do that then they should be forced to take responsibility for fraud. Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result. >>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man. I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
- JimDabell 4y ago
  > It would be actually trivial for a bank to only allow transactions from their apps How?
  - gambiting 4y ago
    What do you mean how? The app has a secure token only the app has, any traffic without that token is invalid. IOS already sandboxes all apps so the token would be impossible to extract. This is basic app security, I can't believe this is even discussed
    - JimDabell 4y ago
      > The app has a secure token only the app has What kind of token? How does it obtain it?
      - xgb84j 4y ago
        This is how I think it roughly works where I live: You get a per-user token directly at the bank or via mail (not email, but a physical envelope). Your banking app can use this token once to get a secret key. Secret key + user name + password allows you to use the banking app. Any way to circumvent this requires app isolation to be broken somehow.
        JimDabell 4y ago
        Sadly, there’s a far more straightforward way. The phisher says “Sorry, your token has expired! You will need to get a new one…” Plenty of people will fall for it. Also, I wouldn’t personally describe an out-of-band token delivery / exchange mechanism like that as “actually trivial” for apps to do.
    - jeroenhd 4y ago
      People extract tokens from apps all the time. Jailbreaks for modern versions of iOS do exist and if they become too hard to pull off, that'll just create a market for pre-jailbroken devices. Tokens embedded into your app can and will be extracted. You can make life harder for criminals by rapidly updating tokens and invalidating all but the last X updates, but I doubt your users are going to like that, and I doubt criminals will be stopped for long with the amount of money at stake. There are ways to make it incredibly difficult for hacked apps but if the file ends up at a user's device, you lose control.
eastbound 4y ago
I hate that baks require the phone app, where transactions don’t also require a computer: It enables racket where my aggressor can list my bank accounts; It also reduces the 2FA to 1FA (phone-only transactions with password + fingerprint + SMS only on the phone).