10 ms·

Ha. Your example is rather specific seeming to me, as I actually work on one of the big 5 Canadian banking iOS apps here in Toronto. For obvious reasons; we do

Ha. Your example is rather specific seeming to me, as I actually work on one of the big 5 Canadian banking iOS apps here in Toronto. For obvious reasons; we don’t ship to alternate stores - even if such a thing as iOS sideloading existed; we wouldn’t support it, and we of course do not support anything but the Play Store on Android. It’s obviously partly a support cost issue - there would be less than 1% of our millions of users using F-Droid, etc - and, more importantly; it’s a security and support issue. I think for a while we even had some sort of check that would detect a jailbroken iPhone or rooted Android device and attempted to refuse to run on them. Security is so far above the #1 priority working in banking it’s insane. We’d never consider anything outside of Apple or Google’s official solutions. We actually have real life contacts at Apple to help address specific security or approval concerns; which is practically unheard of.

logifail 3y ago
> rooted Android device (I'm sure I'm missing the obvious here) but why are you happy to have customers log in using a browser on a device they fully control, yet not do the same using your app on a device they fully control?
- yellowapple 3y ago
  The obvious answer is that they're not happy about it, but that browsers don't give them the access necessary to detect whether the device running said browser is rooted (let alone do anything about it), so they can't pretend they know better about my own device's security than I do.
Zak 3y ago
> I think for a while we even had some sort of check that would detect a jailbroken iPhone or rooted Android device and attempted to refuse to run on them. Your uncertainty about this suggests it's not something you decided, but please let anyone involved in making decisions like that know that's a dick move. It's the user's device, not the bank's.
- lostgame 3y ago
  Oh, I certainly have absolutely no control over those types of decisions. I'm a soldier, not a general, I just do what I'm told, tbh.
smeej 3y ago
Security in banking apps in the U.S. is an absolute joke. I'm glad to hear Canada takes it more seriously. I've used everything from giant multinational banks to local credit unions in the U.S., and none of them will even let me sign in with U2F. Many of them still have password character limits.

logifail 3y ago

> rooted Android device (I'm sure I'm missing the obvious here) but why are you happy to have customers log in using a browser on a device they fully control, yet not do the same using your app on a device they fully control?

yellowapple 3y ago
The obvious answer is that they're not happy about it, but that browsers don't give them the access necessary to detect whether the device running said browser is rooted (let alone do anything about it), so they can't pretend they know better about my own device's security than I do.

Zak 3y ago

> I think for a while we even had some sort of check that would detect a jailbroken iPhone or rooted Android device and attempted to refuse to run on them. Your uncertainty about this suggests it's not something you decided, but please let anyone involved in making decisions like that know that's a dick move. It's the user's device, not the bank's.

lostgame 3y ago
Oh, I certainly have absolutely no control over those types of decisions. I'm a soldier, not a general, I just do what I'm told, tbh.

smeej 3y ago

Security in banking apps in the U.S. is an absolute joke. I'm glad to hear Canada takes it more seriously. I've used everything from giant multinational banks to local credit unions in the U.S., and none of them will even let me sign in with U2F. Many of them still have password character limits.