4 ms·

Not generally possible. Any application that stores any data in the Secure Element of the phone is, by design, not capable of being backed up, even with root.

Not generally possible. Any application that stores any data in the Secure Element of the phone is, by design, not capable of being backed up, even with root. Examples include various bank apps that serve as 2-factor authenticators. Without that, one of the possible solutions is to use NeoBackup on a rooted phone so it backs up everything daily to some external server on your infrastructure. It can be, for example, a NextCloud server.

user_7832 3y ago
> Any application that stores any data in the Secure Element of the phone is, by design, not capable of being backed up, even with root. Examples include various bank apps that serve as 2-factor authenticators. This probably depends a lot on what bank app you have/use. My (large co.) bank app works perfectly fine across my pixel, iPhone and iPad. The “app data” isn’t replicated but since everything comes from the server it’s identical. I can verify and make transactions on either device. Even 2fa apps like MS Authenticator allow you to use multiple devices by storing/syncing the seed via the cloud.
- MichaelZuo 3y ago
  Is it 100% identical in every way perceivable by the user, or only close to identical?
  - user_7832 3y ago
    it's 100% identical to the user. TBH the app doesn't do much. Open it -> see balance and charges and credit/debit etc. Trigger opening it from payment portal -> "verify transaction with biometrics/PIN" -> confirm
    - patrakov 3y ago
      In my case, it's different. Open the app the first time, accept the license, it contacts the server (anonymously, as it doesn't have any user data at this point) and establishes a random TOTP seed and a hex ID (which is an unchanging hex string visible in the UI along with the generated codes). There is no need to log in, and the app does not even have a login form. The bank has a database table that maps the hex ID to the corresponding TOTP seed. From that point on, the app never uses the network. When you open the app the next time, it functions as a regular TOTP generator that keeps the seed in some protected area that cannot be backed up even if you have root (ignoring the license concerns) - except that you can't use the generated codes anywhere. This also means that reinstalling the application, or installing it on a second phone, will result in a new ID and a new TOTP seed, so the two phones will have different hex IDs and different seeds, and thus will not agree on the codes generated. To make the application useful, you need to physically go to the bank and present the running app together with your passport. They will inspect your phone for signs of rooting, dangerous settings or unwanted apps, associate the hex ID displayed by their app with your account (so that the generated TOTP codes start working on their online banking website), and disable the previous one (so you can't use two phones).
      - user_7832 3y ago
        That sounds oddly intense for a bank app. I understand them not wanting a rooted phone and a few of the measures but everything sounds quite interesting/heavy. Would you be okay saying which bank this is or which country you are in? I still wonder if with something like a root hiding thing like grapheneOS’s software this could be “overcome”.
        patrakov 3y ago
        Metrobank (for business customers) in the Philippines. Regular customers of the same bank have a different app with less strictness. And yes, root hiding works on a test phone (which has a copy of the app not linked to my bank account), and the TOTP seed can be extracted from memory using Fridump and imported into a different app. But obviously, this won't pass the "manual inspection of the phone" step, because they will likely find the renamed Magisk app.
        user_7832 3y ago
        Thanks, that's very interesting that a business account in the Philippines has so much security. I think if a bank tried that here in Europe (inspecting phones) folks wouldn't like the privacy intrusion. Though, I think apps can be hidden from the launcher (and perhaps also the settings app with some more effort)?
rkagerer 3y ago
I'm OK if there are one or two exceptions, like if my banking app needs to be manually reinstalled after 'failover'. Out of curiosity, do open source phones like the Librem 5 or Pinephone Pro have a secure element and if so do they provide you with tools to provision and manage it yourself?

user_7832 3y ago

> Any application that stores any data in the Secure Element of the phone is, by design, not capable of being backed up, even with root. Examples include various bank apps that serve as 2-factor authenticators. This probably depends a lot on what bank app you have/use. My (large co.) bank app works perfectly fine across my pixel, iPhone and iPad. The “app data” isn’t replicated but since everything comes from the server it’s identical. I can verify and make transactions on either device. Even 2fa apps like MS Authenticator allow you to use multiple devices by storing/syncing the seed via the cloud.

MichaelZuo 3y ago
Is it 100% identical in every way perceivable by the user, or only close to identical?
- user_7832 3y ago
  it's 100% identical to the user. TBH the app doesn't do much. Open it -> see balance and charges and credit/debit etc. Trigger opening it from payment portal -> "verify transaction with biometrics/PIN" -> confirm
  - patrakov 3y ago
    In my case, it's different. Open the app the first time, accept the license, it contacts the server (anonymously, as it doesn't have any user data at this point) and establishes a random TOTP seed and a hex ID (which is an unchanging hex string visible in the UI along with the generated codes). There is no need to log in, and the app does not even have a login form. The bank has a database table that maps the hex ID to the corresponding TOTP seed. From that point on, the app never uses the network. When you open the app the next time, it functions as a regular TOTP generator that keeps the seed in some protected area that cannot be backed up even if you have root (ignoring the license concerns) - except that you can't use the generated codes anywhere. This also means that reinstalling the application, or installing it on a second phone, will result in a new ID and a new TOTP seed, so the two phones will have different hex IDs and different seeds, and thus will not agree on the codes generated. To make the application useful, you need to physically go to the bank and present the running app together with your passport. They will inspect your phone for signs of rooting, dangerous settings or unwanted apps, associate the hex ID displayed by their app with your account (so that the generated TOTP codes start working on their online banking website), and disable the previous one (so you can't use two phones).
    - user_7832 3y ago
      That sounds oddly intense for a bank app. I understand them not wanting a rooted phone and a few of the measures but everything sounds quite interesting/heavy. Would you be okay saying which bank this is or which country you are in? I still wonder if with something like a root hiding thing like grapheneOS’s software this could be “overcome”.
      - patrakov 3y ago
        Metrobank (for business customers) in the Philippines. Regular customers of the same bank have a different app with less strictness. And yes, root hiding works on a test phone (which has a copy of the app not linked to my bank account), and the TOTP seed can be extracted from memory using Fridump and imported into a different app. But obviously, this won't pass the "manual inspection of the phone" step, because they will likely find the renamed Magisk app.
        user_7832 3y ago
        Thanks, that's very interesting that a business account in the Philippines has so much security. I think if a bank tried that here in Europe (inspecting phones) folks wouldn't like the privacy intrusion. Though, I think apps can be hidden from the launcher (and perhaps also the settings app with some more effort)?

rkagerer 3y ago

I'm OK if there are one or two exceptions, like if my banking app needs to be manually reinstalled after 'failover'. Out of curiosity, do open source phones like the Librem 5 or Pinephone Pro have a secure element and if so do they provide you with tools to provision and manage it yourself?