3 ms·
In some sense they are. But being protected either from a consequence of my own stupidity or a consequence of their lack of security. I think the worst part of
by godelski 1y ago
In some sense they are. But being protected either from a consequence of my own stupidity or a consequence of their lack of security. I think the worst part of all is that these "bandaids" are being used in place of actual security. I don't need to be protected from my own stupidity nor do I need security theater.
- Aerroon 1y agoIt doesn't really protect anything though, because you can always just use an external camera to take a picture of your screen.
- Cloudef 1y agoIts probably meant to try mitigate damage in case bad actor gets remote access to your phone or you have malware.
- const_cast 1y agoIf your phone is remotely rooted, the screenshot is providing no security.
- godelski 1y agoSounds like they need to spend more money on security and their "good enough" solutions aren't actually good enough.
- ncruces 1y agoIt protects less proficient users from accidentally taking a screenshot.
- mr_mitm 1y agoI think the threat model here is that a different, malicious app (compromised, installed accidentally or by the means of social engineering) might take screenshots of your screen and forward them to take advantage of you. You can file this under one's "own stupidity" as well, sure, but in the end they're not protecting you, they're protecting themselves, because banks might be liable for these kind of things, and by imposing these restrictions, they're reducing the amount of fraud and thus improve their bottom line.
- franga2000 1y agoI see this argument everywhere and I've never heard of a case where a bank was liable because a customer was phished. I've even asked for examples and nobody ever provided them. It's one thing to argue in court that they should be liable because they didn't provide you with the necessary security tools (like MFA), but they all provide at least SMS 2FA these days and their apps run on iOS and Android, both of which have plenty of security features.
- cwillu 1y agoIf a bank is required to reverse fraudulent charges (and they are), that means they're liable for those charges.
- izacus 1y agoIn reality what happened is that some security auditor put it into a checklist for the mobile app "Security ISO certificate++" and now everyone implements it for compliance. Fighting against that is insane paperwork and professional exposure for software engineers that do it (since if people get phished, the C-suite will point a finger at a tech lead which went against the "professional security audit"). Most of other posts here are just post-rationalization and victim blaming.
- godelski 1y agoSo let's have more of these conversations so the idiots making those standards make fewer dumb rules and we can grease the wheels for anyone passionate enough to try to get it changed
- BrandoElFollito 1y agoUnfortunately the idiots are often the nation's security agency, or a large consulting company. You will not have them change their policies if they do not have a good person inside, who will slowly move the boat. I fought for audit findings because they were pissing me off at a personal level and it wirked. But the auditor did not change their procedure, just reverted the finding. Until the next year.