6 ms·

I'll buy them once I can access all of my banks on it, that is literally the only thing holding me to IOS or Anroid at the minute

tmtvl 1y ago
Then tell your banks they have to support the PinePhone or they'll lose you as a customer. The PinePhone folks don't have access to the source code of whatever interface your banks provide on Android/iOS, so they can't do anything about it.
AnthonyMouse 1y ago
NB: Attestation has no security value here because if the phone isn't compromised then the owner having root isn't a security problem and if the phone is compromised then the user is entering their bank login into a fake scam app that doesn't require attestation regardless of what the real one does. But because the banks that require this are cargo culting some nonsense, they require iOS or Google Android but don't really care how old the phone is. Which means you can transfer your cellular plan to the phone you actually want to use and then just keep your existing phone indefinitely to run the bank app over WiFi or tethering.
- charcircuit 1y ago
  What is protecting against another app on a PinePhone from stealing your bank's authentication token?
  - AnthonyMouse 1y ago
    There are two possible scenarios here. The first is that your phone is not compromised. In this case there is no other app trying to steal your bank's authentication token. This is true regardless of which OS you use or whether you have magisk installed or what other code you put on your phone that isn't trying to steal your bank's authentication token. The second is that your phone is compromised. Then what prevents the device from capturing your bank credentials is the same as if you use a compromised phone running Google Android: Nothing. If you enter your bank credentials into a compromised phone, the attacker gets them. Attestation can't prevent this because the phone is compromised, so the login screen isn't from a bank app that requires attestation, it's from a scam app which is exfiltrating your credentials.
    - charcircuit 1y ago
      >Nothing This is far from the truth assuming by compromised you mean that the user has installed a malicous app. Android has proper sandboxing which means that other apps can't read the token owned by the bank app. This is part of the Android security model and attestation is evidence that the Android security model is being enforced. Phishing apps are different from an app that steals existing authentication tokens on the device.
      - fc417fc802 1y ago
        You aren't responding to the scenario that was posed. You're assuming an isolated compromised app on an otherwise clean device. GP is assuming a compromised device. Of course attestation does nothing to improve the "single compromised app" case since (assuming Android) that goes nowhere either way. The only thing attestation does is meddle in end user affairs.
        charcircuit 1y ago
        >if the phone isn't compromised then the owner having root isn't a security problem The scenario is the phone isn't compromised. Having root means you, or an app you run can bypass the security protecting the authentication token.
        fc417fc802 1y ago
        And now you're being intentionally difficult. Please interpret things in the most plausible manner. Beyond common decency, it's part of the site guidelines. By "not compromised" GP clearly meant a scenario where no malicious apps are present. I agree that's a serious omission. I responded to your scenario (a nonzero number of malicious apps) in my earlier comment. Any Android device will defend against that regardless of the presence of attestation. Any non-android device can still use online banking and thus attestation doesn't appear to accomplish anything legitimate. Building out proper support for hardware tokens would provide superior security in approximately all cases. The specific "root on android" scenario isn't generally a concern. Typical implementations require explicitly granting the capability to a given app. A malicious app can't gain it without fooling the user, at which point it could more easily phish the credentials and possibly even proxy an entire session.
  - fc417fc802 1y ago
    What's protecting me when I do online banking in the browser, which I can do using more or less any device? The answer is that targeted attacks against the average middle to lower class individual are rare enough that there are far more worthwhile things to worry about. Such as the vast majority of banks (at least in the US) not supporting hardware tokens.
    - charcircuit 1y ago
      >What's protecting me when I do online banking in the browser Modern operating systems will protect the cookies from being stolen from other applications on the system.
      - deleted 1y ago
        [deleted]
    - jolmg 1y ago
      > What's protecting me when I do online banking in the browser, which I can do using more or less any device? IDK about your country, but it's also common for banks to require supplying a token from the phone's banking app in order to login via the browser.
      - AnthonyMouse 1y ago
        And what does that buy you? The user goes to the bank website in a compromised browser, attacker gets their password. Bank sends a code to their phone, user types the code into the compromised browser, attacker gets the code.
      - fc417fc802 1y ago
        Not in the US, at least so far. If that were ever to come to pass I would be in danger of becoming unbanked. I flatly refuse to install third party proprietary software on my phone (I grudgingly accept firmware blobs for lack of a realistic alternative). Here the majority continue to use SMS based 2FA rather than supporting TOTP or hardware tokens. Note that TOTP can be handled by any app of the user's choosing, doesn't facilitate attestation or any other user hostile practices, and in practice means that an attack requires physical theft of the device. While the theory might differ, in practice the effective security level is equivalent to other (objectionable) schemes.

tmtvl 1y ago

Then tell your banks they have to support the PinePhone or they'll lose you as a customer. The PinePhone folks don't have access to the source code of whatever interface your banks provide on Android/iOS, so they can't do anything about it.

AnthonyMouse 1y ago

NB: Attestation has no security value here because if the phone isn't compromised then the owner having root isn't a security problem and if the phone is compromised then the user is entering their bank login into a fake scam app that doesn't require attestation regardless of what the real one does. But because the banks that require this are cargo culting some nonsense, they require iOS or Google Android but don't really care how old the phone is. Which means you can transfer your cellular plan to the phone you actually want to use and then just keep your existing phone indefinitely to run the bank app over WiFi or tethering.

charcircuit 1y ago
What is protecting against another app on a PinePhone from stealing your bank's authentication token?
- AnthonyMouse 1y ago
  There are two possible scenarios here. The first is that your phone is not compromised. In this case there is no other app trying to steal your bank's authentication token. This is true regardless of which OS you use or whether you have magisk installed or what other code you put on your phone that isn't trying to steal your bank's authentication token. The second is that your phone is compromised. Then what prevents the device from capturing your bank credentials is the same as if you use a compromised phone running Google Android: Nothing. If you enter your bank credentials into a compromised phone, the attacker gets them. Attestation can't prevent this because the phone is compromised, so the login screen isn't from a bank app that requires attestation, it's from a scam app which is exfiltrating your credentials.
  - charcircuit 1y ago
    >Nothing This is far from the truth assuming by compromised you mean that the user has installed a malicous app. Android has proper sandboxing which means that other apps can't read the token owned by the bank app. This is part of the Android security model and attestation is evidence that the Android security model is being enforced. Phishing apps are different from an app that steals existing authentication tokens on the device.
    - fc417fc802 1y ago
      You aren't responding to the scenario that was posed. You're assuming an isolated compromised app on an otherwise clean device. GP is assuming a compromised device. Of course attestation does nothing to improve the "single compromised app" case since (assuming Android) that goes nowhere either way. The only thing attestation does is meddle in end user affairs.
      - charcircuit 1y ago
        >if the phone isn't compromised then the owner having root isn't a security problem The scenario is the phone isn't compromised. Having root means you, or an app you run can bypass the security protecting the authentication token.
        fc417fc802 1y ago
        And now you're being intentionally difficult. Please interpret things in the most plausible manner. Beyond common decency, it's part of the site guidelines. By "not compromised" GP clearly meant a scenario where no malicious apps are present. I agree that's a serious omission. I responded to your scenario (a nonzero number of malicious apps) in my earlier comment. Any Android device will defend against that regardless of the presence of attestation. Any non-android device can still use online banking and thus attestation doesn't appear to accomplish anything legitimate. Building out proper support for hardware tokens would provide superior security in approximately all cases. The specific "root on android" scenario isn't generally a concern. Typical implementations require explicitly granting the capability to a given app. A malicious app can't gain it without fooling the user, at which point it could more easily phish the credentials and possibly even proxy an entire session.
- fc417fc802 1y ago
  What's protecting me when I do online banking in the browser, which I can do using more or less any device? The answer is that targeted attacks against the average middle to lower class individual are rare enough that there are far more worthwhile things to worry about. Such as the vast majority of banks (at least in the US) not supporting hardware tokens.
  - charcircuit 1y ago
    >What's protecting me when I do online banking in the browser Modern operating systems will protect the cookies from being stolen from other applications on the system.
    - deleted 1y ago
      [deleted]
  - jolmg 1y ago
    > What's protecting me when I do online banking in the browser, which I can do using more or less any device? IDK about your country, but it's also common for banks to require supplying a token from the phone's banking app in order to login via the browser.
    - AnthonyMouse 1y ago
      And what does that buy you? The user goes to the bank website in a compromised browser, attacker gets their password. Bank sends a code to their phone, user types the code into the compromised browser, attacker gets the code.
    - fc417fc802 1y ago
      Not in the US, at least so far. If that were ever to come to pass I would be in danger of becoming unbanked. I flatly refuse to install third party proprietary software on my phone (I grudgingly accept firmware blobs for lack of a realistic alternative). Here the majority continue to use SMS based 2FA rather than supporting TOTP or hardware tokens. Note that TOTP can be handled by any app of the user's choosing, doesn't facilitate attestation or any other user hostile practices, and in practice means that an attack requires physical theft of the device. While the theory might differ, in practice the effective security level is equivalent to other (objectionable) schemes.