3 ms·

> Anyway, I hope that Android becoming more and more user-hostile (and more specifically in this case power-user-hostile) will move more and more people to cust

by wink 3y ago

> Anyway, I hope that Android becoming more and more user-hostile (and more specifically in this case power-user-hostile) will move more and more people to custom ROMs. What about people who kinda gave up tinkering with custom ROMs because the state of the stuff that matters (root checks by your mandatory banking app, some Google stuff) is either not documented (good luck finding an overlap of "phone model" + "your local bank app" + custom ROM" as a tested and known-good thing). I'm all for freedom and choice, but I don't think unless you're willing to go through a couple of phones, a couple of days of work, or are a specialist in the first place, this is a reasonable way of action for average phone users. I know you said "power users", but I'm a power user with computers, my phones could be a lot dumber if I had my way - but it won't happen if we have to increasingly use them as MFA devices or be at the whim of corporations with a better lever (i.e. banks, I'm not changing my bank account 3 times until I find one with an app that works on a rooted phone...)

fsflover 3y ago
> What about people who kinda gave up tinkering with custom ROMs Such people should consider GNU/Linux phones, Librem 5 and Pinephone as an investment in the future.
nilespotter 3y ago
Just use the bank's PWA, you'll be fine. Or sandboxed play services in a separate GOS user.
- aftbit 3y ago
  Outside of the USA, some banks require mobile apps. If you don't have a working attested phone in these countries, banking becomes decidedly 20th century.
- vetinari 3y ago
  It is different issue than that. European banks are forced by EU's Payment Services Directive 2 (PSD2) to authenticate using MFA for any payment over 50 EUR. So what is the second factor? Your phone. Once you pair the app in your phone with your account, you can authenticate your actions using that phone, even if you are otherwise banking using the web app on your computer. Most banks also insist on using their apps, they don't allow generic second factors. Since their apps require Android with SafeNet or iOS, they pretty much enforce the Google/Apple duopoly. For now, there are other ways -- sms, which the banks are trying to phase out. So I imagine situation elsewhere will be very similar.
  - daef 3y ago
    I don't know where you're from, but here in austria most banks offer 'cardTAN' as an alternative to mobileTAN. I always assumed cardTAN is a thing everywhere... edit: with cardTAN you get a OTP/TAN 'calculator' into which you put your smartcard to generate TANs on the fly. I use it because to me this feels more like a real second factor, when I use my mobile for banking.
    - vetinari 3y ago
      The DACH world is specific in many things... but I've seen cardTAN outside it. In Slovakia, Tatra banka does use this system. I guess being part of Raiffeisen explains it.
    - 4ad 3y ago
      cardTAN is being rapidly phased out in Austria.
    - jacquesm 3y ago
      Same here in NL, for now. But: banks are pushing their apps hard, to the point where every authentication you have to manually switch - again - to indicate that you want to use the token generator and not their app (never mind cookies and so on, those are only for the marketing department, when for once they could actually use them to store your preferences). And there will likely be a time when the bank simply cuts access to the cardTAN system and only allow their apps. Screw them because that means I have to use a smartphone, which I really do not want. The cardTAN system has been very good so far in preventing fraud, once the phone is the token it suddenly gets a lot more complicated and less secure.
    - wink 3y ago
      Fun fact, I still have the thing here, used it for many years, but they made it obsolete. App only now. It's a German Sparkasse :(
    - PeterStuer 3y ago
      That used to be the universal way here (Belgium) before the banks went all in with apps. I'm not sure wether typing a challange/response into a browser is inherently more secure than a phone app. For those wondering about 2FA with these apps, factor 1 is "something you own" namely that particular phone/sim, and factor 2 is "something you know", your PIN. You can still use cardTAN, but the app is way more convenient, especially with QR.
- Izkata 3y ago
  > Just use the bank's PWA, you'll be fine. Just over a month ago, a proposal to prevent that was posted here: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940
  - bob1029 3y ago
    The authors of the PWAs would need to opt-in to this. We distribute LOB banking apps as PWAs to our customers. In no reality would I consider incorporating this into our tech stack. We use PWAs and avoid native apps precisely to maximize compatibility across arbitrary IT policies in our various customer installs. I don't know if our customers want to use linux, windows, android or apple. I don't WANT to know anymore. I just want to target a common API (HTML5), add some bandaids for iOS/Safari (usually after WWDC each year) and move on with life. Throwing DRM and platform constraints into the mix sounds like I might as well go back to native (I won't). We are one of the few vendors that will actually get into a heated argument and push back against customers over FUD security crap like this. If a prospect insists that we add some draconian DRM to our product stack, I would make it very clear to leadership that I do not think we should do business with that customer on technical grounds. If you find yourself in a situation where you need to trust the client implicitly, then you have catastrophically failed in the rest of your design.
    - jabroni_salad 3y ago
      I appreciate what you do if you really do deliver that, but plenty of FIs are happy to mandate things like Trusteer Rapport and I would anticipate that sector to jump onto WEI just as fast as media companies will. It's going to be sold to execs as a zero operational cost lightswitch solution to preventing account hijacks. Up until about a year ago one major core provider had been using the password 'money' for all their client accounts, many of which were domain admins since that is a 'just make it work' button and they cannot actually tell you what privs their service accounts need. When we asked the clients to press them on it, we determined via cracking that they had changed it to 'monet' as a workaround. The standards for excellence are SO LOW.
      - 3y ago
- Spoom 3y ago
  Check deposit and Zelle is only available in the app.
benabbottnz 3y ago
The two things that stopped me from using custom Android ROMs: 1. Discovered that emergency calls would crash the phone (during an emergency) 2. The LineageOS April Fools prank.
- pierat 3y ago
  Presumably as an April Fools' joke, LineageOS added an undismissable notification informing users that, "You might be a victim of software counterfeiting" Removing it requires updating to another build or rebooting into recovery and changing a setting using terminal via setprop . instructions: Okay I finally managed to solve the LineageOS Settings"You might be a victim of counterfeiting" april fools joke. Here are the steps to how I solved it 1. Boot in to TWRP-recovery 2. Open Terminal under the advanced tap 3. Type the following "setprop persist.lineage.nofool true" in the terminal 4. Reboot the phone and voila :)
  - phito 3y ago
    What a terrible idea...
    - benabbottnz 3y ago
      It made me realise that these huge and reputable Android ROM developers will still treat your phone like a toy, and are therefore completely untrustworthy.
- bayindirh 3y ago
  3. You can't use trusted SIM services such as e-signature with custom ROMs. I have an e-signature embedded into the cryptographic module of my SIM card, and no custom ROM can use that, because they can't provide a secure pipe from SIM to antenna, and that's a deal breaker.
  - phh 3y ago
    Uh, that doesn't make sense to me. Could you provide some details? The point of SIM card is that there is no user-controlled software in the path between SIM card and antenna. So if the pipe from SIM to antenna was secure before custom ROM, it's still secure after it.
thot_experiment 3y ago
Magisk and Shamiko together have been working well for me to hide root from Google Pay/my bank app for the past year or so (fingers crossed, ymmv). Highly recommend the experience of having a rooted phone though, it's a nice feeling controlling your device, especially being able to control the traffic and just like... run unix utilities natively. I really wish it was something I didn't have to spend so much effort achieving but it has been worth it. I find the experience of using a device I don't have full control over beyond irritating.

by wink 3y ago

fsflover 3y ago

> What about people who kinda gave up tinkering with custom ROMs Such people should consider GNU/Linux phones, Librem 5 and Pinephone as an investment in the future.

nilespotter 3y ago

Just use the bank's PWA, you'll be fine. Or sandboxed play services in a separate GOS user.

aftbit 3y ago
Outside of the USA, some banks require mobile apps. If you don't have a working attested phone in these countries, banking becomes decidedly 20th century.
vetinari 3y ago
It is different issue than that. European banks are forced by EU's Payment Services Directive 2 (PSD2) to authenticate using MFA for any payment over 50 EUR. So what is the second factor? Your phone. Once you pair the app in your phone with your account, you can authenticate your actions using that phone, even if you are otherwise banking using the web app on your computer. Most banks also insist on using their apps, they don't allow generic second factors. Since their apps require Android with SafeNet or iOS, they pretty much enforce the Google/Apple duopoly. For now, there are other ways -- sms, which the banks are trying to phase out. So I imagine situation elsewhere will be very similar.
- daef 3y ago
  I don't know where you're from, but here in austria most banks offer 'cardTAN' as an alternative to mobileTAN. I always assumed cardTAN is a thing everywhere... edit: with cardTAN you get a OTP/TAN 'calculator' into which you put your smartcard to generate TANs on the fly. I use it because to me this feels more like a real second factor, when I use my mobile for banking.
  - vetinari 3y ago
    The DACH world is specific in many things... but I've seen cardTAN outside it. In Slovakia, Tatra banka does use this system. I guess being part of Raiffeisen explains it.
  - 4ad 3y ago
    cardTAN is being rapidly phased out in Austria.
  - jacquesm 3y ago
    Same here in NL, for now. But: banks are pushing their apps hard, to the point where every authentication you have to manually switch - again - to indicate that you want to use the token generator and not their app (never mind cookies and so on, those are only for the marketing department, when for once they could actually use them to store your preferences). And there will likely be a time when the bank simply cuts access to the cardTAN system and only allow their apps. Screw them because that means I have to use a smartphone, which I really do not want. The cardTAN system has been very good so far in preventing fraud, once the phone is the token it suddenly gets a lot more complicated and less secure.
  - wink 3y ago
    Fun fact, I still have the thing here, used it for many years, but they made it obsolete. App only now. It's a German Sparkasse :(
  - PeterStuer 3y ago
    That used to be the universal way here (Belgium) before the banks went all in with apps. I'm not sure wether typing a challange/response into a browser is inherently more secure than a phone app. For those wondering about 2FA with these apps, factor 1 is "something you own" namely that particular phone/sim, and factor 2 is "something you know", your PIN. You can still use cardTAN, but the app is way more convenient, especially with QR.
Izkata 3y ago
> Just use the bank's PWA, you'll be fine. Just over a month ago, a proposal to prevent that was posted here: https://news.ycombinator.com/item?id=36875940 https://news.ycombinator.com/item?id=36875940
- bob1029 3y ago
  The authors of the PWAs would need to opt-in to this. We distribute LOB banking apps as PWAs to our customers. In no reality would I consider incorporating this into our tech stack. We use PWAs and avoid native apps precisely to maximize compatibility across arbitrary IT policies in our various customer installs. I don't know if our customers want to use linux, windows, android or apple. I don't WANT to know anymore. I just want to target a common API (HTML5), add some bandaids for iOS/Safari (usually after WWDC each year) and move on with life. Throwing DRM and platform constraints into the mix sounds like I might as well go back to native (I won't). We are one of the few vendors that will actually get into a heated argument and push back against customers over FUD security crap like this. If a prospect insists that we add some draconian DRM to our product stack, I would make it very clear to leadership that I do not think we should do business with that customer on technical grounds. If you find yourself in a situation where you need to trust the client implicitly, then you have catastrophically failed in the rest of your design.
  - jabroni_salad 3y ago
    I appreciate what you do if you really do deliver that, but plenty of FIs are happy to mandate things like Trusteer Rapport and I would anticipate that sector to jump onto WEI just as fast as media companies will. It's going to be sold to execs as a zero operational cost lightswitch solution to preventing account hijacks. Up until about a year ago one major core provider had been using the password 'money' for all their client accounts, many of which were domain admins since that is a 'just make it work' button and they cannot actually tell you what privs their service accounts need. When we asked the clients to press them on it, we determined via cracking that they had changed it to 'monet' as a workaround. The standards for excellence are SO LOW.
    - 3y ago
Spoom 3y ago
Check deposit and Zelle is only available in the app.

benabbottnz 3y ago

The two things that stopped me from using custom Android ROMs: 1. Discovered that emergency calls would crash the phone (during an emergency) 2. The LineageOS April Fools prank.

pierat 3y ago
Presumably as an April Fools' joke, LineageOS added an undismissable notification informing users that, "You might be a victim of software counterfeiting" Removing it requires updating to another build or rebooting into recovery and changing a setting using terminal via setprop . instructions: Okay I finally managed to solve the LineageOS Settings"You might be a victim of counterfeiting" april fools joke. Here are the steps to how I solved it 1. Boot in to TWRP-recovery 2. Open Terminal under the advanced tap 3. Type the following "setprop persist.lineage.nofool true" in the terminal 4. Reboot the phone and voila :)
- phito 3y ago
  What a terrible idea...
  - benabbottnz 3y ago
    It made me realise that these huge and reputable Android ROM developers will still treat your phone like a toy, and are therefore completely untrustworthy.
bayindirh 3y ago
3. You can't use trusted SIM services such as e-signature with custom ROMs. I have an e-signature embedded into the cryptographic module of my SIM card, and no custom ROM can use that, because they can't provide a secure pipe from SIM to antenna, and that's a deal breaker.
- phh 3y ago
  Uh, that doesn't make sense to me. Could you provide some details? The point of SIM card is that there is no user-controlled software in the path between SIM card and antenna. So if the pipe from SIM to antenna was secure before custom ROM, it's still secure after it.

thot_experiment 3y ago

Magisk and Shamiko together have been working well for me to hide root from Google Pay/my bank app for the past year or so (fingers crossed, ymmv). Highly recommend the experience of having a rooted phone though, it's a nice feeling controlling your device, especially being able to control the traffic and just like... run unix utilities natively. I really wish it was something I didn't have to spend so much effort achieving but it has been worth it. I find the experience of using a device I don't have full control over beyond irritating.