> running either Apple's or Google's proprietary OS And specifically a non-rooted, locked bootloader, remotely attested version. Running your own code on your

> running either Apple's or Google's proprietary OS And specifically a non-rooted, locked bootloader, remotely attested version. Running your own code on your own device is suspicious behavior you know! This is already somewhat the case with banking apps, but luckily it's usually possible to hide root for now And, yes, I get there are legitimate worries about malware and that does kind of solve them, but we've managed with desktop web banking (though not if Google's proposal succeeds). AFAIK most financial scams are executed by social engineering. 2FA (which is now mandated in the EU) is a more effective protection than locking down one endpoint Barclay's was doing 2FA via an offline code generator (looks like a calculator) where you put in your card and entered a PIN since what feels like at least 10 years ago. I know most users would prefer mobile 2FA, but I wish they'd kept that as an option, whereas AFAIK they're phasing it out In any case, de facto saying "you must pay dues to either Apple or Google to bank on the go" is quite bad for free competition