4 ms·

I fail to see how your conclusion follows from the premise. Banking apps in the US don't even show any PINs for 2FA, so, why exactly is Schwab doing that again

by cnst 1y ago

I fail to see how your conclusion follows from the premise. Banking apps in the US don't even show any PINs for 2FA, so, why exactly is Schwab doing that again? BTW, Google Wallet does let you take screenshots of all the views except for just one or two views where you enter card number, billing and card security code. Honestly, even that is an overreach; it's not like I can't use the camera to take a photo of my credit card with CVV in view, so, why should the camera function of any app prevent that again? Google never blocks screenshots of any transactions, last-4 of any card, or any other screens. If they ever did, I'd be far less happy with them, and would go out of my way to find an alternative contactless provider. Wells Fargo used to provide contactless on Android in their app for their own cards, but, probably thanks to Apple, this feature was removed for feature parity with iOS.

charcircuit 1y ago
>why should the camera function of any app prevent that again? Because you taking a photo of it with a physical camera is intentional. Another app on the device screen recording that view may not be intentional by the user.
- yjftsjthsd-h 1y ago
  > Another app on the device screen recording that view may not be intentional by the user. Given how many permission prompts you have to go through to let any app see your screen, I feel to see how it would be unintentional.
  - watwut 1y ago
    Not more then for any other app. Android design is such that it intentionally trains users to accept everything.
    - cnst 1y ago
      Surely you're talking about Apple's design, no? With Android, I routinely prohibit random app permissions from many apps, and everything still works just fine. Does Apple even let you have as fine of a control of permissions as you can have on Android?
    - yjftsjthsd-h 1y ago
      Yes, more than anything else: https://github.com/cvzi/ScreenshotTile?tab=readme-ov-file#technical-details https://github.com/cvzi/ScreenshotTile?tab=readme-ov-file#te... Depending on method and version of Android, you have to jump through ridiculous steps to allow screenshots.
      - immibis 1y ago
        Their point was that you have to jump through ridiculous steps to allow anything at all, so users are trained to jump through them.
        yjftsjthsd-h 1y ago
        I feel fairly confident asserting that users are not trained to go through the steps to enable screenshots. Blindly clicking allow is one thing. Going back and forth to enable restricted settings and then grant the permission is quite another. I use a screenshot app, and am pretty technical, and it took me multiple tries and several minutes including having to go read https://support.google.com/android/answer/12623953#allowrestrictedsettings https://support.google.com/android/answer/12623953#allowrest... because Android is so concerned with protecting me.
        immibis 1y ago
        Not screenshots specifically. Every app requires you to accept a whole bunch of permission prompts.
        yjftsjthsd-h 1y ago
        Yes, by blindly clicking allow. But in this thread we're arguing about specifically problems with screenshots, which are behind much stronger permission gates that can't be blindly clicked through.
        watwut 1y ago
        Yes. Plus these are not even ridiculous steps, not for capturing the screen. The bigger issue is users being spammed permission requests in broad categories that you cant deny. Like a headphones needing contacts permission.
  - charcircuit 1y ago
    Starting the recording may have been intentional, but the recording of sensitive content may not be. For example Twitch streamers frequently leak their personal information by accident. If that personal information could automatically be blacked out it would save them from trouble.
gspencley 1y ago
You're laser focusing on MFA sniffing, specifically. The point is that malware can take screenshots to harvest information. Your banking information has a ton of sensitive information about you that could be used for a variety of different purposes, such as for identity theft. My point was that making it impossible to take screenshots is trying to protect against the possibility that there is malware harvesting anything through screenshots.

by cnst 1y ago

charcircuit 1y ago

>why should the camera function of any app prevent that again? Because you taking a photo of it with a physical camera is intentional. Another app on the device screen recording that view may not be intentional by the user.

yjftsjthsd-h 1y ago
> Another app on the device screen recording that view may not be intentional by the user. Given how many permission prompts you have to go through to let any app see your screen, I feel to see how it would be unintentional.
- watwut 1y ago
  Not more then for any other app. Android design is such that it intentionally trains users to accept everything.
  - cnst 1y ago
    Surely you're talking about Apple's design, no? With Android, I routinely prohibit random app permissions from many apps, and everything still works just fine. Does Apple even let you have as fine of a control of permissions as you can have on Android?
  - yjftsjthsd-h 1y ago
    Yes, more than anything else: https://github.com/cvzi/ScreenshotTile?tab=readme-ov-file#technical-details https://github.com/cvzi/ScreenshotTile?tab=readme-ov-file#te... Depending on method and version of Android, you have to jump through ridiculous steps to allow screenshots.
    - immibis 1y ago
      Their point was that you have to jump through ridiculous steps to allow anything at all, so users are trained to jump through them.
      - yjftsjthsd-h 1y ago
        I feel fairly confident asserting that users are not trained to go through the steps to enable screenshots. Blindly clicking allow is one thing. Going back and forth to enable restricted settings and then grant the permission is quite another. I use a screenshot app, and am pretty technical, and it took me multiple tries and several minutes including having to go read https://support.google.com/android/answer/12623953#allowrestrictedsettings https://support.google.com/android/answer/12623953#allowrest... because Android is so concerned with protecting me.
        immibis 1y ago
        Not screenshots specifically. Every app requires you to accept a whole bunch of permission prompts.
        yjftsjthsd-h 1y ago
        Yes, by blindly clicking allow. But in this thread we're arguing about specifically problems with screenshots, which are behind much stronger permission gates that can't be blindly clicked through.
      - watwut 1y ago
        Yes. Plus these are not even ridiculous steps, not for capturing the screen. The bigger issue is users being spammed permission requests in broad categories that you cant deny. Like a headphones needing contacts permission.
- charcircuit 1y ago
  Starting the recording may have been intentional, but the recording of sensitive content may not be. For example Twitch streamers frequently leak their personal information by accident. If that personal information could automatically be blacked out it would save them from trouble.

gspencley 1y ago

You're laser focusing on MFA sniffing, specifically. The point is that malware can take screenshots to harvest information. Your banking information has a ton of sensitive information about you that could be used for a variety of different purposes, such as for identity theft. My point was that making it impossible to take screenshots is trying to protect against the possibility that there is malware harvesting anything through screenshots.