3 ms·

Yeah, running GrapheneOS, this has been a big headache for me. And it's incredibly stupid too. The app won't work natively due to a lack of attestation, so I h

Yeah, running GrapheneOS, this has been a big headache for me. And it's incredibly stupid too. The app won't work natively due to a lack of attestation, so I have to fire up the browser and user the service.... Exactly how is that more anti-abuse than just using an app without attestation? It's security theater and has no basis in reality.

gjsman-1000 2y ago
Can you scan a check from your web browser? Maybe I'm wrong, but probably not; frankly, it's a logistical miracle we can do this from our phones and the banks tolerate it, but I can see why they would still want to minimize all risk involved. The second reason though I can think a bank would want attestation is as an anti-piracy measure. With a website, you have HTTPS verifying the identity of the domain. With an app, a pirated app or a 3rd party app from any source could hypothetically intercept user's banking information, their scanned checks, or even attempt to cash their scanned checks itself. It's not about making sure the device is secure, as it is killing attempts at 3rd party, modified, or malicious clients. The last thing I want, or the bank wants, is some grandmother downloading the "Wells Fargo Bank Plus with Giant Legible Accessible Text" app she saw in an ad as an APK, installing it, and being a victim of silent fraud for years. The third reason a bank might want it, is also just simple stupid litigant America. If such a scheme similar to the above were to occur, the bank would likely be sued by victims arguing that the above circumstance was preventable. The victims would also be correct, it was preventable. The bank is then in the unenviable position of telling the jury that supporting the rights of 0.1% of phone modders was more important than victimized grandmothers. Or, as a bank lawyer would say, just turn on attestation, it costs basically nothing, and then none of the above could happen. Better safe than sorry. After all, is the grandmother not also a customer, and preventing malicious clients in her best interest? Sure, some customers will be inconvenienced, but this is America, where anyone depositing more than $10K is subject to an interrogation.
- acaloiar 2y ago
  > Can you scan a check from your web browser? Yes https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
  - NewJazz 2y ago
    Just because the browser offers that api does not mean that a bank will use it
- ensignavenger 2y ago
  Why would some one pirate a free banking app that they get for free from their bank anyway?
- fiso64 2y ago
  >The last thing I want, or the bank wants, is some grandmother downloading the "Wells Fargo Bank Plus with Giant Legible Accessible Text" app she saw in an ad as an APK, installing it, and being a victim of silent fraud for years. I don't think this happens nowadays. Android will either block by default or give you a million prompts and warnings before it allows you to install an apk from an unknown source. It's far, far easier to install it from google play. I don't think any grandmother would manage to accidentally ignore the first 3 pages of genuine links on google and then push the right buttons that enable sideloading.
  - Semaphor 2y ago
    A million prompts? It's exactly one prompt to permanently allow a source.
- toast0 2y ago
  > Can you scan a check from your web browser? Maybe I'm wrong, but probably not; frankly, it's a logistical miracle we can do this from our phones and the banks tolerate it, but I can see why they would still want to minimize all risk involved. ATMs just scan the checks now too, so why have the middle man? Usually there are limits on customer scanned deposits though, in the range of $5,000-$25,000. I've never heard of a limit on ATM deposits, although I'm sure there is one; I have had atms in WA decline to process warrants from CA state (like a check, but sometimes California has to wait for next fiscal year to clear it).
- deleted 2y ago
  [deleted]
Abishek_Muthian 2y ago
GrapheneOS seems to be advocating for hardware attestation to solve this issue, taking advantage of its boot-loader re-locking capabilities but its vehemently being opposed by Lineage OS community due to privacy concerns and that boot-loader re-locking is not an option in LOS. [1] https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...

gjsman-1000 2y ago

Can you scan a check from your web browser? Maybe I'm wrong, but probably not; frankly, it's a logistical miracle we can do this from our phones and the banks tolerate it, but I can see why they would still want to minimize all risk involved. The second reason though I can think a bank would want attestation is as an anti-piracy measure. With a website, you have HTTPS verifying the identity of the domain. With an app, a pirated app or a 3rd party app from any source could hypothetically intercept user's banking information, their scanned checks, or even attempt to cash their scanned checks itself. It's not about making sure the device is secure, as it is killing attempts at 3rd party, modified, or malicious clients. The last thing I want, or the bank wants, is some grandmother downloading the "Wells Fargo Bank Plus with Giant Legible Accessible Text" app she saw in an ad as an APK, installing it, and being a victim of silent fraud for years. The third reason a bank might want it, is also just simple stupid litigant America. If such a scheme similar to the above were to occur, the bank would likely be sued by victims arguing that the above circumstance was preventable. The victims would also be correct, it was preventable. The bank is then in the unenviable position of telling the jury that supporting the rights of 0.1% of phone modders was more important than victimized grandmothers. Or, as a bank lawyer would say, just turn on attestation, it costs basically nothing, and then none of the above could happen. Better safe than sorry. After all, is the grandmother not also a customer, and preventing malicious clients in her best interest? Sure, some customers will be inconvenienced, but this is America, where anyone depositing more than $10K is subject to an interrogation.

acaloiar 2y ago
> Can you scan a check from your web browser? Yes https://developer.mozilla.org/en-US/docs/Web/API/MediaDevices/getUserMedia#browser_compatibility https://developer.mozilla.org/en-US/docs/Web/API/MediaDevice...
- NewJazz 2y ago
  Just because the browser offers that api does not mean that a bank will use it
ensignavenger 2y ago
Why would some one pirate a free banking app that they get for free from their bank anyway?
fiso64 2y ago
>The last thing I want, or the bank wants, is some grandmother downloading the "Wells Fargo Bank Plus with Giant Legible Accessible Text" app she saw in an ad as an APK, installing it, and being a victim of silent fraud for years. I don't think this happens nowadays. Android will either block by default or give you a million prompts and warnings before it allows you to install an apk from an unknown source. It's far, far easier to install it from google play. I don't think any grandmother would manage to accidentally ignore the first 3 pages of genuine links on google and then push the right buttons that enable sideloading.
- Semaphor 2y ago
  A million prompts? It's exactly one prompt to permanently allow a source.
toast0 2y ago
> Can you scan a check from your web browser? Maybe I'm wrong, but probably not; frankly, it's a logistical miracle we can do this from our phones and the banks tolerate it, but I can see why they would still want to minimize all risk involved. ATMs just scan the checks now too, so why have the middle man? Usually there are limits on customer scanned deposits though, in the range of $5,000-$25,000. I've never heard of a limit on ATM deposits, although I'm sure there is one; I have had atms in WA decline to process warrants from CA state (like a check, but sometimes California has to wait for next fiscal year to clear it).
deleted 2y ago
[deleted]

Abishek_Muthian 2y ago

GrapheneOS seems to be advocating for hardware attestation to solve this issue, taking advantage of its boot-loader re-locking capabilities but its vehemently being opposed by Lineage OS community due to privacy concerns and that boot-loader re-locking is not an option in LOS. [1] https://grapheneos.org/articles/attestation-compatibility-guide https://grapheneos.org/articles/attestation-compatibility-gu...