10 ms·

My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on,

My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like. I like that they have iphones. Doing internet banking on their phone is safer than doing it on their desktop computer. Why is that? The reason is that the desktop PC security model is deeply flawed. In modern desktop operating systems, we protect user A from user B. But any program running on my computer is - for some reason - completely trusted with my data. Any program I run is allowed to silently edit, delete or steal anything I own. Unless you install special software, you can't even tell if any of this is happening. This makes every transitive dependency of every program on your computer a potential attack vector. I want computers to be hackable. But I don't also want my computer to be able to be hacked so easily. Right now, I have to choose between doing banking on my (maybe - hopefully - safe) computer. Or doing banking on my definitely safe iphone. What a horrible choice. Personally I think we need to start making computers that provide the best of both worlds. I want much more control over what code can do on my computer. I also want programs to be able to run in a safe, sandboxed way. But I should be the one in charge of that sandbox. Not Google. Definitely not Apple. But there's currently no desktop environment that provides that ability. I think the argument against locked down computers (like iphones and androids) would be a lot stronger if linux & friends provided a real alternative that was both safe and secure. If big companies are the only ones which provide a safe computing experience, we're asking for trouble.

nuker 1y ago
> My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like. Purists always forget this point :) What is best for 99% of people. And dumb Euro bureaucrats.
- quaintdev 1y ago
  Why not give people the freedom to choose what they want
  - nuker 1y ago
    It will be exploited. Key word above - not tech savvy. The only reason we have convenient banking, gov and streaming apps today is because of guaranteed and enforced mobile security by big boys Apple and Google. (Google being Ad company is another matter, not relevant here).
    - fr4nkr 1y ago
      No, we have convenient online services in spite of the endless security theater that permeates consumer tech. All it's done is gradually increase maintenance burden and technical complexity until useful features are slowly stripped out to create a more "streamlined" experience. The mobile app for my credit union has become so shitty that I'm not even sure if losing access to it is a deal-breaker for rooting my phone - I already prefer to do my online banking and shopping on my laptop. There is no "just works" technical solution for a problem caused mainly by naivete and gullibility. Governments and the private sector know this, of course; as others have said, the real purpose is to control users, not to protect them.
      - nuker 1y ago
        > No, we have convenient online services in spite of the endless security theater that permeates consumer tech. Disagree. No banking app can resist root access owned by attacker.
        donkeybeer 1y ago
        Why is the banking server trusting the client? Thats criminally incompetent security. If your website gets hacked because a client had "root" whose fault is it?
        jamespo 1y ago
        Because the unknowing user has entered their auth credentials?
- necovek 1y ago
  That's what can be achieved by encapsulation/containerization of apps: a la flatpak, snaps, docker or VMs... I found my parents to install random crappy adware apps from official stores too. What protects their banking application is granular permissions, not root access.
ozgrakkurt 1y ago
What are the stats here, this sounds like pure bs to be honest. Main way people around me get scammed by far like 90% is social engineering
- DataDynamo 1y ago
  It will need just one more additional authentication factor and blocking side loading apps on Android - We promise, total security is close! /s
  - josephg 1y ago
    I don't think we'll ever have total security. But we still put locks on our doors and send our internet traffic through TLS. All or nothing thinking is counterproductive.
  - ozgrakkurt 1y ago
    Don’t forget to change your password every week too
- deleted 1y ago
  [deleted]
spaqin 1y ago
Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures. You can also choose to do your banking at the physical branch. We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely available if you needed it as well; these permissions could be locked or frozen if there is concern about users, just like work devices are provisioned with limitations. It all depends on your threat model.
- Rohansi 1y ago
  Also the good old phishing emails/links. So many people are simply unaware when a website is pretending to look like an app/floating window. Even younger people who you'd hope know better are falling for it today. I work on a PC game and players (mostly young adults) are constantly getting their accounts compromised by the same phishing sites that pop up monthly. AI voice and video cloning scams are also only going to increase. Why would scammers need to get people to install random APKs when they can just impersonate a family member and tell them what to give directly? To me it seems very much like the classic "think of the children" type argument. It's not going to really fix anything in the end but it will benefit Google.
- rahkiin 1y ago
  In the netherlands we do not have physical branches anymore. They died out. All banking started to go through browser. This was very sensitive to malware and viruses, so two-factor was added through phones. Then less and less people had PCs because phone provides enough. Now mobile apps for banking is the only way to do banking. Or it is required for MFA. Even if you’re calling with the bank it is used as MFA
  - AndyMcConachie 1y ago
    I still do banking through a random reader at ABN AMRO. I really hope they never get rid of it because I trust that little dumb plastic device 1000% more than my phone.
extraisland 1y ago
Everything in life is about trade-offs. Certain trade-offs people aren't going to make. - If you want to run an alternative operating system, you got to learn how it works. That is a trade off not even many tech savvy people want to make. - There is a trade-off with a desktop OS. I actually like the fact that it isn't super sand-boxed and locked down. I am willing to trade security & safety for control. > Personally I think we need to start making computers that provide the best of both worlds. I want much more control over what code can do on my computer. I also want programs to be able to run in a safe, sandboxed way. But I should be the one in charge of that sandbox. Not Google. Definitely not Apple. But there's currently no desktop environment that provides that ability. The market and demand for that is low. BTW. This does exist with Qubes OS already. However there are a bunch of trade-offs that most people are unlikely to want to make. https://www.qubes-os.org/ https://www.qubes-os.org/
- tonyhart7 1y ago
  exactly, people want all the benefit without the consequences like if there are OS utopia exist that has all the advantage without the downside then everybody would use that but people complaining don't live in reality
  - extraisland 1y ago
    A lot of it already exists in one form or another and the trade-off for sand-boxing is usability a lot of the time. It isn't even a freedom vs security. It is usability vs security.
    - josephg 1y ago
      > It is usability vs security. I think a lot of it is "nobody has bothered building it yet" vs security. Eg Qubes runs everything in Xen isolates - which is a wildly complex, performance limiting way to do sandboxing on modern computers. There are much better ways to implement sandboxing that don't limit performance or communication between applications. For example SeL4's OS level capability model. SeL4 still allows arbitrary IPC / shared memory between processes. Or Solaris / Illumos's Zones. But that route would unfortunately require rewriting / changing most modern software.
sim7c00 1y ago
most reason OSes are insecure is bexause they are designed badly regarding security. they are from a time it wasnt important and most ways of building them also from that same era. its hardly modernized -_-. sure its not the same OS as 20 years back,... it has a lot of layers of junk ontop. again, no incentive to improve it. its either unpaid work or the OS vendor has a stake in it being insecure. (both exists)
matheusmoreira 1y ago
> think of the elderly This stuff is not just for the elderly and computer illiterate. It's for you as well. You think they're going to stop? You're giving up freedom for safety. You will have neither.
- josephg 1y ago
  > It's for you as well. You think they're going to stop? No! Which is why I don't want every npm package I install to have unfettered access to my internet connection and to access all my files. If this is being exploited now, I might not even know! How sloppy is that! > You're giving up freedom for safety. At the limit, sure, maybe there are tradeoffs between freedom and security. But there's lots of technical solutions that we could build right now that give a lot more safety without losing any freedom at all. Like sandboxing applications by default. Applications should by default run on my computer with the same permissions as a browser tab. Occasionally applications need more access than that. But that should require explicit privilege escalation rather than being granted to all programs by default. (Why do I need to trust that spotify and davinci resolve won't install keyloggers on my computer? Our computers are so insecure!) Personally I'd like to see all access to the OS happen through a capability model. This would require changes in the OS and in programming languages. But the upside is it would mean we could fearlessly install software. And if you do it right, even `npm install` could be entirely safe. Here's how we do it: First, all syscalls need to pass unforgable capability tokens. (Eg SeL4). No more "stringy" syscalls. For safe 3rd party dependencies, inside processes we first make an "application capability" that is passed to main(). 3rd party libraries don't get access to any OS objects at all by default. But - if you want to use a 3rd party library to do something (like talk to redis), your program crafts a capability token with access to that specific thing and then passes it to the library as an argument. Bad: // Stringy API. Redis client can do anything. redisClient.connect("127.0.0.1", 6379) Good: redisConnCap = systemCap.narrow(TCPConnect, "127.0.0.1", 6379) redisClient.connect(redisConnCap) This way, the redis library can only make outgoing connections on the specified TCP port. Everything else - including the filesystem - is off limits to this library. This would require some PL level changes too. Like, it wouldn't be secure if libraries can access arbitrary memory within your process. In a language like rust we'd need to limit unsafe code. (And maybe other stuff?). In GC languages like C# and javascript its easier - though we might need to tweak the standard libraries. And ban (or sandbox) native modules like napi and cgo.
999900000999 1y ago
As is Android has support for multi user more. Get some real sandboxing, let me install whatever I want in my sandbox. That's a bare minimum. I also want "I am an adult" mode where I get to do what I want. If Google wants to flag secure net, fine. Not every thing is going to work.
- disiplus 1y ago
  yeah this whole shit where lets optimize it for the lowest common denominator is stupid. I hate everything about it. im a older millennial, so i have older parents and young kids. My father could not bother with a smartphone or does not care about internet at all. My mother uses whatsapp and everything after initial year she is quite handy with it. Im not scared about her, im more scared that she is reading AI slop. My kids are now at the age where a lot of the pears are getting a smartphone for them im not giving them a smartphone. If i give them a smartphone in a year or i will be using parental controls.
realusername 1y ago
Well no, if your parents truly are tech illiterate, I would give them Ubuntu and not an iPhone. With the iPhone they get the risk of answering to a scam call or scam sms and giving them the access of their bank account. Ubuntu is almost bullet proof for beginners. In fact, that's what I've done for my parents and I had to retire the computer and get another one because it's the hardware which became too old after 15 years of running Ubuntu without any problem. Security for users isn't just about bootloader expoits.
- charcircuit 1y ago
  Like the parent said Ubuntu has horrible security. It would be better to just not buy a phone line for the iphone if you don't want phone calls or texts.
  - realusername 1y ago
    It hasn't, security isn't just technical features but a social contract. Even on an iPhone without a sim card, they can download one of the scam casino games from the appstore and give away a lot of money, on Ubuntu they can't do that. There's more to security than just bytes. The threats to your average user isn't a bootloader exploit built by some Israeli firm but privacy breaches, social engineering and scams.
    - josephg 1y ago
      Sure; but technical features can certainly make security better. Like, iOS makes most unsafe actions incredibly clear. Apple pay always requires the user to double tap the power button. The OS makes it impossible for an application to charge you money through apple pay without an explicit user action. Phone apps also can't take control of my entire device, or steal my cookies or cryptolocker my hard drive. Any program you download and run from the internet on a desktop computer can do all of this stuff and more. We shouldn't allow that stuff by default on desktop computers either. Phones have the right idea. I just don't want Apple and Google to be the only ones who can modify the system at the OS level.
lentil_soup 1y ago
But you can choose, your parents can have a phone with the "lockdown" setting turned on and I can have it off if I want. How we expose and handle that setting is a UX problem we can solve. What's wrong with that?
- mlrtime 1y ago
  Because parents typically have bad eyes and need big monitors, or they just want to be able to use a computer like we have been for years?
vrighter 1y ago
All this will do is ensure that if malware does get through the official channels (which it can and regularly does) it will be more widely distributed
- josephg 1y ago
  Security doesn't need to be 100% effective to add value. The more hoops we make scammers jump through, the fewer people will end up getting scammed. I know angle grinders exist. I still lock up my bike.
  - vrighter 1y ago
    Scams have absolutely nothing to do with anything relevant. Scams happen regardless of whether software is installed in the first place. Social engineering is what most scams are based on. Refusing me banking access because I want to use my phone as a computer brings extra security to nobody.
AndyMcConachie 1y ago
The answer to this is a physical switch on the machine that enables/disables hackability.
KoolKat23 1y ago
This is where Linux and Apple's centralized repository method shines. Social engineering is really where the threat is at these days.
mike_hearn 1y ago
> Any program I run is allowed to silently edit, delete or steal anything I own ... there's currently no desktop environment that provides that ability Putting aside the philosophical issues, that statement isn't true for a few years now. It's not well known, even in very technical circles like HN, but macOS actually sandboxes every app: • All apps from outside the app store are always sandboxed to a lesser degree, even if they are old and don't opt-in. • All apps from outside the app store may opt in to stricter sandboxing for security hardening purposes. • All apps from the app store are forced to opt-in, must declare their permissions in a fine grained way, and Apple reviews them to make sure they make sense. To see this is true try downloading a terminal emulator you haven't used before, and then use it to navigate into your Downloads, Photos, Documents etc folders and run "ls". You'll get a permission prompt from the OS telling you the app is requesting access to that folder. If you click deny, ls will return a permission error. Now try using vim to edit the Info.plist file of something in /Applications. ls will tell you that you have UNIX write permissions, but you'll find you can't actually edit the file. The kernel blocks apps from tampering with each other's files. Finally, go into the settings and privacy/security area. You can now enable full disk access for the terminal emulator, or a finer grained permission like managing apps. Restart the terminal and permissions work like you'd expect for UNIX again. Note that you won't see any permission popup in a GUI app if you open the file via the file picker dialog box. That's because the dialog box is a "powerbox" controlled by the OS, so the act of picking the file grants the app permission implicitly. Same for drag and drop, opening via the finder, etc. The permission prompt only appears when an app directly uses syscalls to open a file without some OS-controlled GUI interaction taking place. So, if you want a desktop OS with a strong sandbox that you actually control, and which has good usability, and a high level of security too, then you should be using macOS. It's the only OS that has managed this transition to all-sandboxed-all-the-time.
- hollerith 1y ago
  >It's the only OS that has managed this transition to all-sandboxed-all-the-time. Apps are all-sandboxed-all-the-time on iOS and Android, too; right?
  - 1y ago
m4rtink 1y ago
Is it really safer on a phone ? Don't banking apps reject latest community Androids builds with all the CVE fixes or Graphene OS yet work totally fine on years old, full of vulnerabilities yet signed official Android ROMs ?
- tuetuopay 1y ago
  Sadly yes. The average joe is not a target for technical exploits that use CVEs. They are, however, targets for meatsack exploits tricking them in installing crap like remote control software.
GoblinSlayer 1y ago
In this case I install Linux Mint. No virus problem. This is a popularity problem: you are more likely to have a sandbox escape on iphone than a virus on PC, because iphone gets more attention.
fsflover 1y ago
> I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like So you need to install Qubes OS for them?
mcv 1y ago
Good point. The current security model of desktop OSs sucks. I was recently reminded of this by an issue at work. I'm used to devs having admin rights on their laptops, but here they closed that down: you have to request admin rights for a specific purpose, and then you get them for a week. I recently requested those rights again because I needed to install something new for a PoC I was working on, and that wasn't allowed anymore. But during onboarding I had those rights and installed homebrew to more easily install dev tools, and homebrew keeps its admin rights to install stuff in a directory owned by admin. So that circumvents this whole security model (and I did, for my PoC). The problem is that it's all or nothing. Homebrew should have the right only to install in a specific directory. Apps shouldn't automatically get access to potentially sensitive data. Mobile OSs handle that sort of thing more granularly. Desktop OSs should too. Because the overly restrictive security rules at my work are little more than security theatre when it's so easy to circumvent.
- mlrtime 1y ago
  It's not theater, your IT department just isn't implementing it correctly. I recently switched jobs and gave up one macbook pro for another (work issued). Company A gave me sudo access and I could do anything I wanted. Company B locks down everything, no sudo, no brew, nothing. But I do get a big VM with root to do anything I want. There is an approved "appstore" of many different varieties of IDEs/tools. TLDR: Not having brew is not a problem, and /can be/ a better experience if done right. It took a couple weeks to shift the mental model but I have no problems. The dev experience is quite good because they provide all the libraries you need to do your job.
  - mcv 1y ago
    There is an app store here too, but lots of vital dev tools simply aren't in there. We should probably make sure they get added.
  - turboat 1y ago
    Interesting. If you don't mind, I have a few questions: 1. Is the "big VM with root" running macOS itself, or a different OS? 2. Do you do any work on the bare metal version of macOS, or do you just start the VM in the morning and do everything from there? 3. How do you experience the performance/UX of the VM? 4. Do you know why Company B IT has set up this VM solution, instead of a plain old MacBook locked down with Apple's enterprise management tools? 5. Can you explain more about the App Store? Is it the actual Apple App Store but restricted to a curated set of apps, or is it a different system? If so, is the store a custom in-house thing or is it provided by a vendor?
komali2 1y ago
This argument doesn't contradict the article. An expensive iPhone ships with iOS and a rigid security model. If you tap the `about` button 16 times and click a confirmation dialog, you disable certain security mechanisms against arbitrary software installation. Do something else easy but impossible to do accidentally, and you unlock the bootloader. You progressively lose portions of your warranty in doing so. This is the path I think we should be going down.
- josephg 1y ago
  Citation please? It’s my understanding that there is no officially approved way to unlock an iPhone. They’ve had something like that for a long time on Android, and I think it’s a reasonable middle ground between making the platform open and closed. But as far as I know, Apple never did something like that on iOS.
  - komali2 1y ago
    That was my fictional proposal, I wasn't clear enough about that in my post.
raxxorraxor 1y ago
It is the other way around. The security model of mobile devices seriously inhibits innovation and we end up with ever the same crappy apps we don't really need. I also don't believe more people get scammed on PC compared to mobile platforms. Scammers go where the most naive people congregate. A sensibly configured Linux system is very secure compared to your mobile device. No security model can really shield against user stupidity. The people would need completely different devices as they simply aren't fit to use a computer. My parents are the same, but I won't accept a bad compromise of an OS just because they essentially need other devices. At some point a user will be asked to allow execution of code they got through some fishy mail. There is no defense against that other than for the user sticking to books.
- hollerith 1y ago
  >A sensibly configured [desktop, i.e., not just a headless server] Linux system is very secure compared to your mobile device. That is not true. It is understandable that you believe it because it gets repeated a lot, but those repeaters are doing what you are, namely repeating what they heard (and sometimes what they want to be true) without sufficient actual knowledge of what they are talking about.
  - raxxorraxor 1y ago
    It is fairly true, what is your definition here? The main attack vector today is malicious mails being opened. These usually don't target linux systems and fail to execute. Sure, it is circumstancial security, but exploits exist for mobile devices as well.
    - hollerith 1y ago
      Media decoders are an important attack vector. Examples include PDF viewers and the library that produces thumbnails for display by the file browser. (One way to attack a media decoder is to get the user to open a malicious email, but there are other ways.) The web browser is an important attack vector, and there are no Linux distros that sandboxes the browser anywhere near as effectively as Android and ChromeOS do except maybe Qubes, but Qubes is stuck using X for the display server and using Zen, both of which have been abandoned by their maintainers and aren't receiving enough maintenance attention to fix security vulnerabilities. I.e., Qubes's reputation for security probably comes from the fact that it was relatively secure many years ago. Android and ChromeOS use selinux to sandbox the browser. Fedora uses selinux, too, but it only sandboxes server software: any program including a web browser started by the user is unconstrained (unaffected) by Fedora's selinux implementation. The kernel is another important attack vector (and Linus has always been bored by and impatient with security considerations.) Ditto the C library. Note that GrapheneOS uses a special, hardened C libary (which in the last few years has migrated to at least one security-focused Linux distro, namely, secureblue, but of course none of the people that show up here on HN proudly proclaiming that Linux is more secure than iOS or Android use secureblue, and the lead of the secureblue project freely admits that MacOS iOS Android and ChromeOS are more secure than secureblue is). You know how one of the arguments for Wayland is the fact that there is no way to prevent any process from reading the contents of any X window? Well, to actually achieve this "window privacy" inherent in Wayland requires active support from the compositor, and Gnome has the only Wayland compositor that actually provides this support. Till the vulnerability started getting exploited some time last year, anyone could upload a theme to KDE's theme store that could run arbitrary code when the user chose to install it. No one was reviewing uploaded themes for malware or warning users of the danger. Hyprland uses a trampoline (files at a known location in the file system that are occasionally executed by Hyprland) for reasons that are hard to explain if we assume that Hyprland's maintainers care anything about security.
pixelmonkey 1y ago
What do you mean by "locked down computer." Maybe something like ChromiumOS? Might be a tough sell for the volunteer open source community ("linux & friends") to work on such an alternative "locked down" computing experience. Free and open source software is usually more focused on unlocking use cases, not locking them up. That all said, I basically consider macOS to be a locked down computing experience. So that's my solution for older people. It's not a perfect solution but the Apple closed ecosystem is better designed for the limited use cases of the elderly. Rely on iCloud and built-in Apple approaches to data security as much as possible. For example, an iMac and an iPhone can get all "adulting" use cases done, including typing/receiving emails, printing documents, online banking, government services, and so on. Apple Passwords plus Face ID helps to simplify password-based security. My biggest issue is getting TOTP-based two-factor adopted. Apple Passwords supports this but I usually have to do remote tech support to get it set up initially. It's also annoying that right now, the current generation of iMacs don't support FaceID, because that would simplify authentication across the two primary platforms (desktop/mobile). I would never use this setup myself since I like to run F/OSS everywhere as much as possible. But I am realistic about tech expectations for the elderly who just want to live their life with minimal investment in learning about data/software security. But you're right, along with other commenters, that it's dangerous for society to rely on a monopolist technocorporate overlord (or a pair of overlords forming a de facto duopoly) for the basic administrative tasks of adult living and lawful citizenship.
BlueTemplar 1y ago
KISS : Have a separate device to do banking, and ONLY banking on. (More tech savvy users could instead boot into a different partition.)

nuker 1y ago

> My parents are getting old and they aren't tech savvy. The missing piece here is that I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like. Purists always forget this point :) What is best for 99% of people. And dumb Euro bureaucrats.

quaintdev 1y ago
Why not give people the freedom to choose what they want
- nuker 1y ago
  It will be exploited. Key word above - not tech savvy. The only reason we have convenient banking, gov and streaming apps today is because of guaranteed and enforced mobile security by big boys Apple and Google. (Google being Ad company is another matter, not relevant here).
  - fr4nkr 1y ago
    No, we have convenient online services in spite of the endless security theater that permeates consumer tech. All it's done is gradually increase maintenance burden and technical complexity until useful features are slowly stripped out to create a more "streamlined" experience. The mobile app for my credit union has become so shitty that I'm not even sure if losing access to it is a deal-breaker for rooting my phone - I already prefer to do my online banking and shopping on my laptop. There is no "just works" technical solution for a problem caused mainly by naivete and gullibility. Governments and the private sector know this, of course; as others have said, the real purpose is to control users, not to protect them.
    - nuker 1y ago
      > No, we have convenient online services in spite of the endless security theater that permeates consumer tech. Disagree. No banking app can resist root access owned by attacker.
      - donkeybeer 1y ago
        Why is the banking server trusting the client? Thats criminally incompetent security. If your website gets hacked because a client had "root" whose fault is it?
        jamespo 1y ago
        Because the unknowing user has entered their auth credentials?
necovek 1y ago
That's what can be achieved by encapsulation/containerization of apps: a la flatpak, snaps, docker or VMs... I found my parents to install random crappy adware apps from official stores too. What protects their banking application is granular permissions, not root access.

ozgrakkurt 1y ago

What are the stats here, this sounds like pure bs to be honest. Main way people around me get scammed by far like 90% is social engineering

DataDynamo 1y ago
It will need just one more additional authentication factor and blocking side loading apps on Android - We promise, total security is close! /s
- josephg 1y ago
  I don't think we'll ever have total security. But we still put locks on our doors and send our internet traffic through TLS. All or nothing thinking is counterproductive.
- ozgrakkurt 1y ago
  Don’t forget to change your password every week too
deleted 1y ago
[deleted]

spaqin 1y ago

Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures. You can also choose to do your banking at the physical branch. We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely available if you needed it as well; these permissions could be locked or frozen if there is concern about users, just like work devices are provisioned with limitations. It all depends on your threat model.

Rohansi 1y ago
Also the good old phishing emails/links. So many people are simply unaware when a website is pretending to look like an app/floating window. Even younger people who you'd hope know better are falling for it today. I work on a PC game and players (mostly young adults) are constantly getting their accounts compromised by the same phishing sites that pop up monthly. AI voice and video cloning scams are also only going to increase. Why would scammers need to get people to install random APKs when they can just impersonate a family member and tell them what to give directly? To me it seems very much like the classic "think of the children" type argument. It's not going to really fix anything in the end but it will benefit Google.
rahkiin 1y ago
In the netherlands we do not have physical branches anymore. They died out. All banking started to go through browser. This was very sensitive to malware and viruses, so two-factor was added through phones. Then less and less people had PCs because phone provides enough. Now mobile apps for banking is the only way to do banking. Or it is required for MFA. Even if you’re calling with the bank it is used as MFA
- AndyMcConachie 1y ago
  I still do banking through a random reader at ABN AMRO. I really hope they never get rid of it because I trust that little dumb plastic device 1000% more than my phone.

extraisland 1y ago

Everything in life is about trade-offs. Certain trade-offs people aren't going to make. - If you want to run an alternative operating system, you got to learn how it works. That is a trade off not even many tech savvy people want to make. - There is a trade-off with a desktop OS. I actually like the fact that it isn't super sand-boxed and locked down. I am willing to trade security & safety for control. > Personally I think we need to start making computers that provide the best of both worlds. I want much more control over what code can do on my computer. I also want programs to be able to run in a safe, sandboxed way. But I should be the one in charge of that sandbox. Not Google. Definitely not Apple. But there's currently no desktop environment that provides that ability. The market and demand for that is low. BTW. This does exist with Qubes OS already. However there are a bunch of trade-offs that most people are unlikely to want to make. https://www.qubes-os.org/ https://www.qubes-os.org/

tonyhart7 1y ago
exactly, people want all the benefit without the consequences like if there are OS utopia exist that has all the advantage without the downside then everybody would use that but people complaining don't live in reality
- extraisland 1y ago
  A lot of it already exists in one form or another and the trade-off for sand-boxing is usability a lot of the time. It isn't even a freedom vs security. It is usability vs security.
  - josephg 1y ago
    > It is usability vs security. I think a lot of it is "nobody has bothered building it yet" vs security. Eg Qubes runs everything in Xen isolates - which is a wildly complex, performance limiting way to do sandboxing on modern computers. There are much better ways to implement sandboxing that don't limit performance or communication between applications. For example SeL4's OS level capability model. SeL4 still allows arbitrary IPC / shared memory between processes. Or Solaris / Illumos's Zones. But that route would unfortunately require rewriting / changing most modern software.

sim7c00 1y ago

most reason OSes are insecure is bexause they are designed badly regarding security. they are from a time it wasnt important and most ways of building them also from that same era. its hardly modernized -_-. sure its not the same OS as 20 years back,... it has a lot of layers of junk ontop. again, no incentive to improve it. its either unpaid work or the OS vendor has a stake in it being insecure. (both exists)

matheusmoreira 1y ago

> think of the elderly This stuff is not just for the elderly and computer illiterate. It's for you as well. You think they're going to stop? You're giving up freedom for safety. You will have neither.

josephg 1y ago
> It's for you as well. You think they're going to stop? No! Which is why I don't want every npm package I install to have unfettered access to my internet connection and to access all my files. If this is being exploited now, I might not even know! How sloppy is that! > You're giving up freedom for safety. At the limit, sure, maybe there are tradeoffs between freedom and security. But there's lots of technical solutions that we could build right now that give a lot more safety without losing any freedom at all. Like sandboxing applications by default. Applications should by default run on my computer with the same permissions as a browser tab. Occasionally applications need more access than that. But that should require explicit privilege escalation rather than being granted to all programs by default. (Why do I need to trust that spotify and davinci resolve won't install keyloggers on my computer? Our computers are so insecure!) Personally I'd like to see all access to the OS happen through a capability model. This would require changes in the OS and in programming languages. But the upside is it would mean we could fearlessly install software. And if you do it right, even `npm install` could be entirely safe. Here's how we do it: First, all syscalls need to pass unforgable capability tokens. (Eg SeL4). No more "stringy" syscalls. For safe 3rd party dependencies, inside processes we first make an "application capability" that is passed to main(). 3rd party libraries don't get access to any OS objects at all by default. But - if you want to use a 3rd party library to do something (like talk to redis), your program crafts a capability token with access to that specific thing and then passes it to the library as an argument. Bad: // Stringy API. Redis client can do anything. redisClient.connect("127.0.0.1", 6379) Good: redisConnCap = systemCap.narrow(TCPConnect, "127.0.0.1", 6379) redisClient.connect(redisConnCap) This way, the redis library can only make outgoing connections on the specified TCP port. Everything else - including the filesystem - is off limits to this library. This would require some PL level changes too. Like, it wouldn't be secure if libraries can access arbitrary memory within your process. In a language like rust we'd need to limit unsafe code. (And maybe other stuff?). In GC languages like C# and javascript its easier - though we might need to tweak the standard libraries. And ban (or sandbox) native modules like napi and cgo.

999900000999 1y ago

As is Android has support for multi user more. Get some real sandboxing, let me install whatever I want in my sandbox. That's a bare minimum. I also want "I am an adult" mode where I get to do what I want. If Google wants to flag secure net, fine. Not every thing is going to work.

disiplus 1y ago
yeah this whole shit where lets optimize it for the lowest common denominator is stupid. I hate everything about it. im a older millennial, so i have older parents and young kids. My father could not bother with a smartphone or does not care about internet at all. My mother uses whatsapp and everything after initial year she is quite handy with it. Im not scared about her, im more scared that she is reading AI slop. My kids are now at the age where a lot of the pears are getting a smartphone for them im not giving them a smartphone. If i give them a smartphone in a year or i will be using parental controls.

realusername 1y ago

Well no, if your parents truly are tech illiterate, I would give them Ubuntu and not an iPhone. With the iPhone they get the risk of answering to a scam call or scam sms and giving them the access of their bank account. Ubuntu is almost bullet proof for beginners. In fact, that's what I've done for my parents and I had to retire the computer and get another one because it's the hardware which became too old after 15 years of running Ubuntu without any problem. Security for users isn't just about bootloader expoits.

charcircuit 1y ago
Like the parent said Ubuntu has horrible security. It would be better to just not buy a phone line for the iphone if you don't want phone calls or texts.
- realusername 1y ago
  It hasn't, security isn't just technical features but a social contract. Even on an iPhone without a sim card, they can download one of the scam casino games from the appstore and give away a lot of money, on Ubuntu they can't do that. There's more to security than just bytes. The threats to your average user isn't a bootloader exploit built by some Israeli firm but privacy breaches, social engineering and scams.
  - josephg 1y ago
    Sure; but technical features can certainly make security better. Like, iOS makes most unsafe actions incredibly clear. Apple pay always requires the user to double tap the power button. The OS makes it impossible for an application to charge you money through apple pay without an explicit user action. Phone apps also can't take control of my entire device, or steal my cookies or cryptolocker my hard drive. Any program you download and run from the internet on a desktop computer can do all of this stuff and more. We shouldn't allow that stuff by default on desktop computers either. Phones have the right idea. I just don't want Apple and Google to be the only ones who can modify the system at the OS level.

lentil_soup 1y ago

But you can choose, your parents can have a phone with the "lockdown" setting turned on and I can have it off if I want. How we expose and handle that setting is a UX problem we can solve. What's wrong with that?

mlrtime 1y ago
Because parents typically have bad eyes and need big monitors, or they just want to be able to use a computer like we have been for years?

vrighter 1y ago

All this will do is ensure that if malware does get through the official channels (which it can and regularly does) it will be more widely distributed

josephg 1y ago
Security doesn't need to be 100% effective to add value. The more hoops we make scammers jump through, the fewer people will end up getting scammed. I know angle grinders exist. I still lock up my bike.
- vrighter 1y ago
  Scams have absolutely nothing to do with anything relevant. Scams happen regardless of whether software is installed in the first place. Social engineering is what most scams are based on. Refusing me banking access because I want to use my phone as a computer brings extra security to nobody.

AndyMcConachie 1y ago

The answer to this is a physical switch on the machine that enables/disables hackability.

KoolKat23 1y ago

This is where Linux and Apple's centralized repository method shines. Social engineering is really where the threat is at these days.

mike_hearn 1y ago

> Any program I run is allowed to silently edit, delete or steal anything I own ... there's currently no desktop environment that provides that ability Putting aside the philosophical issues, that statement isn't true for a few years now. It's not well known, even in very technical circles like HN, but macOS actually sandboxes every app: • All apps from outside the app store are always sandboxed to a lesser degree, even if they are old and don't opt-in. • All apps from outside the app store may opt in to stricter sandboxing for security hardening purposes. • All apps from the app store are forced to opt-in, must declare their permissions in a fine grained way, and Apple reviews them to make sure they make sense. To see this is true try downloading a terminal emulator you haven't used before, and then use it to navigate into your Downloads, Photos, Documents etc folders and run "ls". You'll get a permission prompt from the OS telling you the app is requesting access to that folder. If you click deny, ls will return a permission error. Now try using vim to edit the Info.plist file of something in /Applications. ls will tell you that you have UNIX write permissions, but you'll find you can't actually edit the file. The kernel blocks apps from tampering with each other's files. Finally, go into the settings and privacy/security area. You can now enable full disk access for the terminal emulator, or a finer grained permission like managing apps. Restart the terminal and permissions work like you'd expect for UNIX again. Note that you won't see any permission popup in a GUI app if you open the file via the file picker dialog box. That's because the dialog box is a "powerbox" controlled by the OS, so the act of picking the file grants the app permission implicitly. Same for drag and drop, opening via the finder, etc. The permission prompt only appears when an app directly uses syscalls to open a file without some OS-controlled GUI interaction taking place. So, if you want a desktop OS with a strong sandbox that you actually control, and which has good usability, and a high level of security too, then you should be using macOS. It's the only OS that has managed this transition to all-sandboxed-all-the-time.

hollerith 1y ago
>It's the only OS that has managed this transition to all-sandboxed-all-the-time. Apps are all-sandboxed-all-the-time on iOS and Android, too; right?
- 1y ago

m4rtink 1y ago

Is it really safer on a phone ? Don't banking apps reject latest community Androids builds with all the CVE fixes or Graphene OS yet work totally fine on years old, full of vulnerabilities yet signed official Android ROMs ?

tuetuopay 1y ago
Sadly yes. The average joe is not a target for technical exploits that use CVEs. They are, however, targets for meatsack exploits tricking them in installing crap like remote control software.

GoblinSlayer 1y ago

In this case I install Linux Mint. No virus problem. This is a popularity problem: you are more likely to have a sandbox escape on iphone than a virus on PC, because iphone gets more attention.

fsflover 1y ago

> I want my parents to have a computer they can safely do their banking on, without leaving them vulnerable to scams and viruses and the like So you need to install Qubes OS for them?

mcv 1y ago

Good point. The current security model of desktop OSs sucks. I was recently reminded of this by an issue at work. I'm used to devs having admin rights on their laptops, but here they closed that down: you have to request admin rights for a specific purpose, and then you get them for a week. I recently requested those rights again because I needed to install something new for a PoC I was working on, and that wasn't allowed anymore. But during onboarding I had those rights and installed homebrew to more easily install dev tools, and homebrew keeps its admin rights to install stuff in a directory owned by admin. So that circumvents this whole security model (and I did, for my PoC). The problem is that it's all or nothing. Homebrew should have the right only to install in a specific directory. Apps shouldn't automatically get access to potentially sensitive data. Mobile OSs handle that sort of thing more granularly. Desktop OSs should too. Because the overly restrictive security rules at my work are little more than security theatre when it's so easy to circumvent.

mlrtime 1y ago
It's not theater, your IT department just isn't implementing it correctly. I recently switched jobs and gave up one macbook pro for another (work issued). Company A gave me sudo access and I could do anything I wanted. Company B locks down everything, no sudo, no brew, nothing. But I do get a big VM with root to do anything I want. There is an approved "appstore" of many different varieties of IDEs/tools. TLDR: Not having brew is not a problem, and /can be/ a better experience if done right. It took a couple weeks to shift the mental model but I have no problems. The dev experience is quite good because they provide all the libraries you need to do your job.
- mcv 1y ago
  There is an app store here too, but lots of vital dev tools simply aren't in there. We should probably make sure they get added.
- turboat 1y ago
  Interesting. If you don't mind, I have a few questions: 1. Is the "big VM with root" running macOS itself, or a different OS? 2. Do you do any work on the bare metal version of macOS, or do you just start the VM in the morning and do everything from there? 3. How do you experience the performance/UX of the VM? 4. Do you know why Company B IT has set up this VM solution, instead of a plain old MacBook locked down with Apple's enterprise management tools? 5. Can you explain more about the App Store? Is it the actual Apple App Store but restricted to a curated set of apps, or is it a different system? If so, is the store a custom in-house thing or is it provided by a vendor?

komali2 1y ago

This argument doesn't contradict the article. An expensive iPhone ships with iOS and a rigid security model. If you tap the `about` button 16 times and click a confirmation dialog, you disable certain security mechanisms against arbitrary software installation. Do something else easy but impossible to do accidentally, and you unlock the bootloader. You progressively lose portions of your warranty in doing so. This is the path I think we should be going down.

josephg 1y ago
Citation please? It’s my understanding that there is no officially approved way to unlock an iPhone. They’ve had something like that for a long time on Android, and I think it’s a reasonable middle ground between making the platform open and closed. But as far as I know, Apple never did something like that on iOS.
- komali2 1y ago
  That was my fictional proposal, I wasn't clear enough about that in my post.

raxxorraxor 1y ago

It is the other way around. The security model of mobile devices seriously inhibits innovation and we end up with ever the same crappy apps we don't really need. I also don't believe more people get scammed on PC compared to mobile platforms. Scammers go where the most naive people congregate. A sensibly configured Linux system is very secure compared to your mobile device. No security model can really shield against user stupidity. The people would need completely different devices as they simply aren't fit to use a computer. My parents are the same, but I won't accept a bad compromise of an OS just because they essentially need other devices. At some point a user will be asked to allow execution of code they got through some fishy mail. There is no defense against that other than for the user sticking to books.

hollerith 1y ago
>A sensibly configured [desktop, i.e., not just a headless server] Linux system is very secure compared to your mobile device. That is not true. It is understandable that you believe it because it gets repeated a lot, but those repeaters are doing what you are, namely repeating what they heard (and sometimes what they want to be true) without sufficient actual knowledge of what they are talking about.
- raxxorraxor 1y ago
  It is fairly true, what is your definition here? The main attack vector today is malicious mails being opened. These usually don't target linux systems and fail to execute. Sure, it is circumstancial security, but exploits exist for mobile devices as well.
  - hollerith 1y ago
    Media decoders are an important attack vector. Examples include PDF viewers and the library that produces thumbnails for display by the file browser. (One way to attack a media decoder is to get the user to open a malicious email, but there are other ways.) The web browser is an important attack vector, and there are no Linux distros that sandboxes the browser anywhere near as effectively as Android and ChromeOS do except maybe Qubes, but Qubes is stuck using X for the display server and using Zen, both of which have been abandoned by their maintainers and aren't receiving enough maintenance attention to fix security vulnerabilities. I.e., Qubes's reputation for security probably comes from the fact that it was relatively secure many years ago. Android and ChromeOS use selinux to sandbox the browser. Fedora uses selinux, too, but it only sandboxes server software: any program including a web browser started by the user is unconstrained (unaffected) by Fedora's selinux implementation. The kernel is another important attack vector (and Linus has always been bored by and impatient with security considerations.) Ditto the C library. Note that GrapheneOS uses a special, hardened C libary (which in the last few years has migrated to at least one security-focused Linux distro, namely, secureblue, but of course none of the people that show up here on HN proudly proclaiming that Linux is more secure than iOS or Android use secureblue, and the lead of the secureblue project freely admits that MacOS iOS Android and ChromeOS are more secure than secureblue is). You know how one of the arguments for Wayland is the fact that there is no way to prevent any process from reading the contents of any X window? Well, to actually achieve this "window privacy" inherent in Wayland requires active support from the compositor, and Gnome has the only Wayland compositor that actually provides this support. Till the vulnerability started getting exploited some time last year, anyone could upload a theme to KDE's theme store that could run arbitrary code when the user chose to install it. No one was reviewing uploaded themes for malware or warning users of the danger. Hyprland uses a trampoline (files at a known location in the file system that are occasionally executed by Hyprland) for reasons that are hard to explain if we assume that Hyprland's maintainers care anything about security.

pixelmonkey 1y ago

What do you mean by "locked down computer." Maybe something like ChromiumOS? Might be a tough sell for the volunteer open source community ("linux & friends") to work on such an alternative "locked down" computing experience. Free and open source software is usually more focused on unlocking use cases, not locking them up. That all said, I basically consider macOS to be a locked down computing experience. So that's my solution for older people. It's not a perfect solution but the Apple closed ecosystem is better designed for the limited use cases of the elderly. Rely on iCloud and built-in Apple approaches to data security as much as possible. For example, an iMac and an iPhone can get all "adulting" use cases done, including typing/receiving emails, printing documents, online banking, government services, and so on. Apple Passwords plus Face ID helps to simplify password-based security. My biggest issue is getting TOTP-based two-factor adopted. Apple Passwords supports this but I usually have to do remote tech support to get it set up initially. It's also annoying that right now, the current generation of iMacs don't support FaceID, because that would simplify authentication across the two primary platforms (desktop/mobile). I would never use this setup myself since I like to run F/OSS everywhere as much as possible. But I am realistic about tech expectations for the elderly who just want to live their life with minimal investment in learning about data/software security. But you're right, along with other commenters, that it's dangerous for society to rely on a monopolist technocorporate overlord (or a pair of overlords forming a de facto duopoly) for the basic administrative tasks of adult living and lawful citizenship.

BlueTemplar 1y ago

KISS : Have a separate device to do banking, and ONLY banking on. (More tech savvy users could instead boot into a different partition.)