4 ms·

Multiple devices is the answer. Otherwise you end up with people having their banking hacked because they installed a game mod.

Zak 1y ago
This leads to a massive transfer of power from end users to corporations and governments. User-owned computers and the open web limit the ability of such institutions to place demands on users. Is that worth a slight reduction in the rate of bank fraud?
- b_e_n_t_o_n 1y ago
  Depends if you ask someone who gets defrauded of their life savings and work and is financially ruined I suppose.
  - Zak 1y ago
    Most of the time, it's the bank that's on the hook for fraud, which is why they're motivated not to trust that the user's device is sufficiently secure.
    - Gigachad 1y ago
      There’s no world where the bank is on the hook for fraud while also not being allowed to prevent it. Personally I’m ok with the bank being on the hook and their app checking there isn’t malware loaded on the OS. I have my raspberry pi and steam deck for full modding without intermingling it with extremely sensitive computing.
      - deleted 1y ago
        [deleted]
      - antisol 1y ago
        lolwut define "malware".
      - beeflet 1y ago
        I'm not okay with owning a cuck device where the bank manages my OS. So we have a problem.
        b_e_n_t_o_n 1y ago
        We? or you :P
      - lan321 1y ago
        Is this not a solved problem? I used to have a TAN generator for my bank as a separate device I paid like 5 euros for. If you get provided an authenticator and get forced to use it for transfers essentially even if my device is compromised it doesn't matter unless their device also gets compromised. They are then free to lock it as much as they want.
        Gigachad 1y ago
        If it’s just one of those 2FA code generators, that still won’t help if your phone has malware on it. The malware can just modify the transfer as you are making it and have typed in the code. Users would also lose them far more than they lose their phones.
        robinsonb5 1y ago
        I have one of those 2FA code generators, and used to have a different one with a business account, too. In both cases the authorisation challenge/response involves part of the destination account number, so if the details are tampered with by malware the code won't work.
      - Zak 1y ago
        There is such a world, and we live in it. Banks might reduce fraud by repeatedly performing credit checks on customers, for example, but that's usually illegal. Remote attestation doesn't check that there isn't malware; it checks that the OS is approved by one of a short list of corporations. Passing that check is correlated with a reduced risk of certain types of malware being present, but is not quite the same as checking for malware.
- eecc 1y ago
  Careful, recently someone made a similar argument around gun-laws in the US, and it didn't go well for him... /s
Viliam1234 1y ago
I am not an expert, but I think this could be improved if the smartphone operating systems had better security models. For example, an application needs "access to your disk storage", because it needs e.g. to save photos. Okay, let's give it access to its own directory. Or maybe to a subdirectory of "my pictures". But it doesn't need the access to the entire disk, right? Yet in Android, it is all or nothing. Perhaps with better system, we wouldn't have to ban installing game mods, only to make sure that those game mods do not have unreasonable access rights. Or maybe the banking operation could state "I can only be installed when no other app has an access to my private data" or something like that.
- albuic 1y ago
  Most people do not understand any of the authorizations they give to apps and don't want to have to understand it. They will be interested in it only after they got burned. They just want a thing that "works and do x, y and z" without having to worry about it. I think the problem is that big corp got them used to easy security because nobody cared before but now that security is getting harder, big corp has no choice but to gave a sense of security they promised but cannot give anymore.

Zak 1y ago

This leads to a massive transfer of power from end users to corporations and governments. User-owned computers and the open web limit the ability of such institutions to place demands on users. Is that worth a slight reduction in the rate of bank fraud?

b_e_n_t_o_n 1y ago
Depends if you ask someone who gets defrauded of their life savings and work and is financially ruined I suppose.
- Zak 1y ago
  Most of the time, it's the bank that's on the hook for fraud, which is why they're motivated not to trust that the user's device is sufficiently secure.
  - Gigachad 1y ago
    There’s no world where the bank is on the hook for fraud while also not being allowed to prevent it. Personally I’m ok with the bank being on the hook and their app checking there isn’t malware loaded on the OS. I have my raspberry pi and steam deck for full modding without intermingling it with extremely sensitive computing.
    - deleted 1y ago
      [deleted]
    - antisol 1y ago
      lolwut define "malware".
    - beeflet 1y ago
      I'm not okay with owning a cuck device where the bank manages my OS. So we have a problem.
      - b_e_n_t_o_n 1y ago
        We? or you :P
    - lan321 1y ago
      Is this not a solved problem? I used to have a TAN generator for my bank as a separate device I paid like 5 euros for. If you get provided an authenticator and get forced to use it for transfers essentially even if my device is compromised it doesn't matter unless their device also gets compromised. They are then free to lock it as much as they want.
      - Gigachad 1y ago
        If it’s just one of those 2FA code generators, that still won’t help if your phone has malware on it. The malware can just modify the transfer as you are making it and have typed in the code. Users would also lose them far more than they lose their phones.
        robinsonb5 1y ago
        I have one of those 2FA code generators, and used to have a different one with a business account, too. In both cases the authorisation challenge/response involves part of the destination account number, so if the details are tampered with by malware the code won't work.
    - Zak 1y ago
      There is such a world, and we live in it. Banks might reduce fraud by repeatedly performing credit checks on customers, for example, but that's usually illegal. Remote attestation doesn't check that there isn't malware; it checks that the OS is approved by one of a short list of corporations. Passing that check is correlated with a reduced risk of certain types of malware being present, but is not quite the same as checking for malware.
eecc 1y ago
Careful, recently someone made a similar argument around gun-laws in the US, and it didn't go well for him... /s

Viliam1234 1y ago

I am not an expert, but I think this could be improved if the smartphone operating systems had better security models. For example, an application needs "access to your disk storage", because it needs e.g. to save photos. Okay, let's give it access to its own directory. Or maybe to a subdirectory of "my pictures". But it doesn't need the access to the entire disk, right? Yet in Android, it is all or nothing. Perhaps with better system, we wouldn't have to ban installing game mods, only to make sure that those game mods do not have unreasonable access rights. Or maybe the banking operation could state "I can only be installed when no other app has an access to my private data" or something like that.

albuic 1y ago
Most people do not understand any of the authorizations they give to apps and don't want to have to understand it. They will be interested in it only after they got burned. They just want a thing that "works and do x, y and z" without having to worry about it. I think the problem is that big corp got them used to easy security because nobody cared before but now that security is getting harder, big corp has no choice but to gave a sense of security they promised but cannot give anymore.