10 ms·

Answer: bank/financial apps, enterprise apps, government apps and copyrighted media (music, video, games, books, ...). Those are the players that demand excess

• liendolucas 1y ago
  Webapps solve this completely. You login to a service as we have been doing forever. And the control is still on their side when you use a webapp. Almost every single app that is on my phone can be a webapp.
  • ulrikrasmussen 1y ago
    This works only as long as the webapp allows you to log in using a username/password and/or 2FA which is not tied to a smartphone app. More and more countries are moving to digital identity solutions, and while many of them offer hardware tokens as alternatives to apps, the future looks like one where smartphone apps will be only option.
    • ecef9-8c0f-4374 1y ago
      Banking websites will tell you that you need 2FA. Of course you need to use not just any 2FA you need to use their app and of course you don't need a 2FA if you use the app directly for banking. My companys equity app does not even want to run on lineageos. At the moment it looks like a 2 phone will be necessary at some point.
      • ubertaco 1y ago
        Is there anything preventing use of something like Keepass vaults as your 2FA solution?
        • dns_snek 1y ago
          Yes, the fact that these 2FA systems aren't based on time-based one time passwords you're probably thinking of. It's a push notification that you need to open and approve in the official app.
        • Macha 1y ago
          The 2FA is not TOTP, it’s push notifications to the bank’s proprietary app
      • ulrikrasmussen 1y ago
        For now, my banking app actually runs on GrapheneOS. My digital identity app that it requires to log in does not, but luckily my government also offers an NFC chip that I can just scan instead. Two phones is such an unsatisfactory solution because it will be too impractical, too expensive, or both, for the vast majority of people.
      • pndy 1y ago
        The revised Payment Services Directive (PSD2) in EU describes standards of strong authentication and for the end user it means that mostly the bank's mobile app is being used as 2FA for logins and operations within the account I'm not sure if physical tokens are being used anywhere but if they are, that's rather rare nowadays. It may be an option reserved in bigger banks or for business customers - I can see one of banks in my country offers it for a request and not by default. Edit: it seems it's a feature for business indeed and banks opted for Cronto system - https://www.onespan.com/products/transaction-signing/cronto https://www.onespan.com/products/transaction-signing/cronto
  • TeMPOraL 1y ago
    Websites as platform can't solve a problem that's social in nature - that it's allowed and accepted for organizations to have such excessive, invasive levels of control. The parties I accuse of driving this problem didn't suddenly go rogue when smartphones happened. They always wanted this level of control (and much more) - they just couldn't get it until relevant technologies matured enough. I'm not speculating here - we have actual empirical evidence to confirm this. A clear example is that there are several countries that, unlike the US and most of Europe, went all-in on Internet banking back before smartphones. Web limitations and conventions didn't stop them from doing the same thing everyone is doing with the phones now - the banks there just force customers to install malware on their computers, so they can do some remote attestation and KYC (and totally no marketing data collection) on their PCs. Most of the West never had this because of the inverse of leapfrogging phenomenon - big, developed economies had too fast progress and at the same time too much inertia to fully adopt a pre-smartphone solution nation-wide.
    • vbezhenar 1y ago
      My bank had website which I can log in and just use. It does not force me to install anything. I need to type username, password and SMS code, that's about it.
      • TeMPOraL 1y ago
        Because your bank isn't even trying to be secure, relative to what's considered industry standard. Be grateful while it lasts.
        • candiddevmike 1y ago
          Why do you think their bank "isn't even trying to be secure"?
          • TeMPOraL 1y ago
            Because SMS is not considered a secure 2FA mechanism anymore, and hasn't been for a while. If that's the default for that bank, and not GP going out of their way to pick a legacy access path, then they're about a decade behind what's considered industry standard -- which today is querying a second factor not just per login, but also per important operations (money transfers, dispositions, changes in settings), with the second factor being by default a smartphone with hardware and software integrity verified via remote attestation.
  • kube-system 1y ago
    But, it doesn't. The browser is unsupported for many of the above-mentioned applications.
    • jayd16 1y ago
      Can I get an example of a single one that can't be found on the web?
      • kube-system 1y ago
        Netflix? Telegram's push 2FA? Any mobile wallet application? The vast majority of dating apps? Any of the app-only social networks? Basically all keyless entry applications?
        • jayd16 1y ago
          All functionality found on the web.
          • kube-system 1y ago
            Have you tried? * Netflix does not load in a mobile browser, it directs you to download their app. * web.telegram.org sends a 2FA push notification to their app * Apple wallet/ Android wallet do not have web apps * Popular dating apps, e.g. Hinge do not have web apps * Some social network apps, e.g. BeReal do not have web apps. Many others have reduced features. * I have never seen a keyless entry app that supports the web, at least not from a mainstream manufacturer. Can you name a single browser app that can do NFC payments in the US?
            • lanfeust6 1y ago
              Firefox supports Netflix web app. It prompts you to install the Widevine plugin.
        • krzyk 1y ago
          I use Netflix web version on my linux desktop all the time.
  • kuhsaft 1y ago
    Being a web app doesn’t mean shit. We already have DRM encrypted web content where the consuming device requires some attestation to decode. I.e. Widevine.
  • t_mann 1y ago
    They're working hard on shutting that down as well with Passkeys. It's only a matter of time until the only way to log in will be through de-facto proprietary apps.
• ulrikrasmussen 1y ago
  This is why we need laws and regulation. And the most important thing we need is not governments forcing Android to be open, but laws requiring governments to not force their citizens to use locked down hardware. My government, Denmark, is one of the most digitized societies in the world. While the government has allocated money to a committee to investigate how the country can become less dependent on American big tech corporations, at the same time they are planning on launching a mandatory age verification solution in 2026 where the only possibly anonymous way of verifying your age to access e.g. social media will be through a smartphone app running on either Google Android or Apple iOS. These nincompoops do not realize that this move will effectively put every open source alternative at a permanent and severe disadvantage, thus handing Apple and Google, which are already duopolies in the smartphone market, a huge moat that will lock out all future competitors form entering the market. I have written to the relevant government agencies, and while they are nice enough to actually answer questions, their answers reveal that they act as if they are a commercial business and not a government agency that is supposed to act in the interest of the people and preserve their freedom. They argue that they are releasing a solution that will work for the vast majority of platforms and that they are continuously monitoring the market to assess whether they need to add support for other platforms. This is a cost-cutting measure which is maybe okay for a commercial entity targeting a specific market demographic, but it is an absurd way for a government to think. Before the upcoming age verification we already had a national digital identity solution, MitID, which also comes as an app running on Android and iOS, and which is locked down to require strong integrity using Google Play Integrity. But at least here they also offer hardware tokens so people can use their digital identity without owning a smartphone and running an open source OS like Linux on their desktops. But with age verification this is apparently over, all the while the government is lying about actually making an effort to free us from American big tech - they are instead basically forcing us to be their customers now.
  • graemep 1y ago
    I think this is true for other European governments. The UK is has introduced age verification (although not mandated an app) and is pushing for digital ID. If digital ID meets too much pushback plan B is a boiled frog approach by introducing it for children first (the legislation for that is in its final stages). Governments say they want sovereignty but not if they have to pay anything for it. They also like the fact that forcing everyone to do everything through a few big businesses makes surveillance and censorship easy. No need to pass laws, just do deals with a few companies. Governments are all about central control, and its more important to them than what they see as obsolete nonsense about sovereignty.
• 1gn15 1y ago
  Bank apps: Use an ATM, or a second phone. Enterprise apps: Use a second phone, preferably paid for by work. Government apps: Use a second phone, or refuse to use it (since there's likely elderly whom are not on board yet). Copyrighted media: Piracy.
  • TeMPOraL 1y ago
    Which is exactly my point: once you apply these workarounds, you don't need a smartphone anymore. Also: both banks and governments are pushing for 2FA with a mobile device being the primary, and in some cases the only, accepted second factor source.
  • fooqux 1y ago
    "just use a second phone" cannot be the answer because 99% of people will just scoff at that. Instead of buying a second phone, why not just buy one that works? And that's to say nothing of the environmental impact.
    • pjerem 1y ago
      > "just use a second phone" cannot be the answer because 99% of people will just scoff at that. Here we are talking about installing PostmarketOS/Linux on a smartphone. The next milestone is not to get everyone on it. First we need a base of early adopters that are willing to use it despite the drawbacks. The more user those alternatives will get, the more they will be developed, the better it will get. Sure, for the next years, it will be way behind Android or iOS in terms of ease of use, but that's the price to pay to get back control on the device you own that is probably the main computer you use everyday. For me that's not worse than using Linux in the early 2000s, and like Linux in the early 2000s, it may even be _fun_ to be an early adopter of Linux on the smartphone. Now we don't need to migrate everyone to PostmarketOS, we _just_ need an alternative OS for at least the ones who are willing to play with it.
      • fsflover 1y ago
        Why postmarketOS and not Mobian?
• state_less 1y ago
  Back in '99 Linux didn't run Excel/Word/Powerpoint or most games, but I ran it anyway. What others call showstoppers are for me inconveniences. I have a motorolla edge 2024 that I'll load whatever open source phone OS will work well enough to place calls and browse the web. I'll keep another phone for the rare times some corporate/government overlord requires it. Many folks who refuse to use smartphones, similarly own a smartphone they rarely use for systems that require them. My recommendation is to put as little time and energy into closed, locked down platforms as you can. Feel free to complain, but don't forget you can make choices.
  • smaudet 1y ago
    > Feel free to complain, but don't forget you can make choices. Except, this not really a choice or a reasonable work around. Phones are still somewhat expensive, not to mention a time-sink to maintain. Try explaining to your parents or even close relatives that they need to abandon the phone they either spent $$$($) on our spend a $$ monthly on that they should really buy another $$$($) phone and use their "official" device like a company card.
  • TeMPOraL 1y ago
    Technology has a ratchet effect at scale - as a solution becomes widely adopted, it switches from being a convenience to being a necessity, because people start building more stuff on top of it. It's as true of to-the-minute accurate clocks as it is of smartphone banking. You can still run a version of Word from 2004. It's fine, if all you need is to write some thoughts down for yourself. But the moment you need to collaborate with other people via a Word document, you'll find it difficult without the modern version with all its user-hostile aspects - and more importantly, other people will find you difficult to work with. Same applies to other software, web and smartphones, and to everything else in life - the further you deviate from the mainstream, the costlier it is for you. Deviate too much, and you just become a social outcast.
    • micahdeath 1y ago
      Social Outcast here... It's pretty good.
• CuriouslyC 1y ago
  I'm fine with using bank/financial services/media via the web. Other stuff can be emulated. Hopefully I'll never have to buy another closed phone.
  • ulrikrasmussen 1y ago
    This is only until the only 2FA solutions that the bank requires you to use to log in and authorize transactions only come as smartphone apps.
    • WaitWaitWha 1y ago
      to your point, not exactly a one-to-one, but several discount airlines (e.g., RyanAir, PLAY, Allegiant, Frontier, Spirit, Wizz, Flair, AirAsia) already require an app to check in for a flight, or pay a fee. No app (or the horrors, no mobile), it cannot be done on a regular computer, must go to a ticket counter and pay a fee.
      • CuriouslyC 1y ago
        This isn't a problem, these apps will probably run fine under emulators. It's only wildvine/play protect stuff that barfs.
        • TeMPOraL 1y ago
          They'll run fine until they don't, because they'll hook up to remote attestation "for sekhurity" like more important apps do. Not to mention, those apps' vendors don't particularly want you to run their apps in emulators either - there's no use case for this they consider not harmful to their business.
      • folmar 1y ago
        Maybe some, but certainly not all in the list. Neither Ryanair nor Wizzair need app, you can do everything in the browser.
• Chipshuffle 1y ago
  I wonder, if there were an open platform to exist that people use increasingly, maybe that would be incentive enough for at least one bank/financial app to permit that platform just to get a competitive advantage. In the meantime probably the best that can be done is having a regular phone and a banking phone.
  • TeMPOraL 1y ago
    Doubtful - the costs of supporting it far outweighs any gain they'd have. In case of banks, the costs of supporting aren't just about developing software for an additional platform, but also insurance premiums and managing fallout of hacks (which always eventually happen) - both of which would go way up, as the company would be voluntarily supporting endpoint decides that are less secure than "industry standard" minimum.
  • fluidcruft 1y ago
    Maybe the answer is to put whatever the banks etc need on something like a smartwatch. Smartwatch + phone is better than two phones IMHO and they're so tedious to use/install anything on that it reduces the attack surface for hackers etc. Tap to pay or digital signatures or identity, passkeys etc via a smartwatch interaction seems like a good use case. Sort of a souped up yubikey. I don't know how good biometrics is on watches nowadays but my Pixel phone has some sort of camera behind the screen to read fingerprints so I can't imagine its impossible. Even adding a capacitive pad on a band seems plausible. Who knows, I don't feel like biometrics have been a real focus of design in the smartwatches I've used. Personally, I have found smartwatches fairly useless (I do enjoy the activity tracking and notifications but that's not much really) so freeing my phone from bullshit by moving some functions to a watch could increase the value/utility of a some sort of smartwatch. Ultimately, it doesn't need to be that "smart" even.
    • TeMPOraL 1y ago
      Still, the problem is that if you go this way, you'd have to put almost all useful functionality of a modern phone on a smartwatch, at which point you could just ditch the phone. It's not just one tiny use case that's pushing us down the road of increasingly locked down devices. It's most use cases - because no matter the service, it's more profitable for the provider to control what you can and cannot do.
• BeetleB 1y ago
  This. Most of us do not want to carry two phones around. The reality is that there is strong utility for those non-open apps and they will never be replaced by open ones. In some parts of the world, WhatsApp is as necessary as the phone itself. Official business is conducted via it.
  • torben-friis 1y ago
    Communication is the main issue - If you've got whatsapp/telegram/whatever,and a couple others you can handle your own life differently without human interaction being affected. The rest is a personal choice, I'm happy to have a bit higher friction to check my bank's balance for example. Maps is an issue but it can be overcome.
    • throwaway902984 1y ago
      Accessibility is a big issue. The accessibility some of the apps like banking provide are compelling. - not totally unlike the difference between stairs and a ramp.
    • TeMPOraL 1y ago
      > I'm happy to have a bit higher friction to check my bank's balance for example. I find this to actually be a great litmus test for the overall problem. Bank account balance is a basic piece of information that's about me, and that I need to keep track of to effectively live in our modern times. I should be able to access that information non-interactively at any time. But I can't. Ask many banks, you'll get as many reasons for why they can't just allow me to cURL this number off an endpoint with some pre-shared credentials. Most of those reasons are bogus[0]. Now, it's not hard to identify several points where I could observe that information in-flight. There's an API that powers the app. The app itself has UI that could be queried or scrapped; some apps will even communicate this data to other apps when requested. But good luck getting access to any of that non-interactively. This is what all those technologies add up to. The bank says I can't have this information unless my eyeballs are physically looking at the screen displaying it - and the whole tech stack conspires to make sure I can't get it otherwise. It's a trivial and non-critical need, but it's also exemplifying the basic user freedoms being denied to us: the ability to freely process information on my own device. EDIT: Accessibility tools are often the only remaining workaround here, because those are uniquely hard for services to close. And as expected, accessibility became its special privilege category on modern devices, and is increasingly heavily scrutinized and limited by device vendors. -- [0] - They're usually some kind of security or stability point, that's just a fig leaf to cover the actual reason: this is the way they can force you to interact with their app or website daily, creating an extremely valuable marketing channel for their financial products.
• rodolphoarruda 1y ago
  So the last possible community response is to bring back "responsive web apps"(tm) in the browser. And make sure a privacy first mobile web browser is installed.
  • symbogra 1y ago
    Too bad browsers also support device attestation.
• viktorcode 1y ago
  > Answer: bank/financial apps, enterprise apps, government apps and copyrighted media (music, video, games, books, ...). Those are the players that demand excessive control over end-user devices, and thus the ultimate driver behind the problem we're discussing. Those work perfectly via a browser, on any platform where the browser can run. As long as a hypothetical open OS has a browser capable with bog standard modern capabilities, it will be fine
  • TeMPOraL 1y ago
    Remind me again what video quality Netflix gives you when streaming to an open browser on an open OS?
    • viktorcode 1y ago
      You mean Firefox that refuses to support web standards for encoded video streams for ideological reasons?
      • hueho 1y ago
        Wasn't aware of that, can you send a link explaining?
        • ryoshoe 1y ago
          For a while Netflix didn't support 1080p on browsers other than Edge on Windows or Safari on Mac. This has changed somewhat but they still reserve their resolution content for their "blessed" OS/browser combinations https://help.netflix.com/en/node/30081 https://help.netflix.com/en/node/30081
          • viktorcode 1y ago
            It's not just Netflix. It is also FaceTime calls for Firefox. This is the reason why Netflix limits Firefox.
        • 1y ago
• zouhair 1y ago
  This and also phone manufacturers lock us with Google.
• beanjuiceII 1y ago
  relative of mine has t1d and they use their phone app to monitor and give insulin, also alarm them when they are low..trusting outside the reliability of apple and google for this type of stuff i imagine would be difficult.
  • TeMPOraL 1y ago
    There are OSS solutions for glucose monitors and even insulin pumps, and they exist precisely because commercial vendors tend to give at best suboptimal quality even when it comes to medical devices. Sure, most pay attention to not accidentally kill you, but beyond that, their incentives go in opposite direction to your incentives. It's important to have computing freedoms so that people who actually care end-to-end, and don't have financial incentives directed against patients' well-being, are able to build on top of products on the market, fix the enshittification, and improve functionality. (We also need that to close the loop. It's a common story that meh products of today, which improve on bad products of yesterday, are just commercializing the fixes developed by people fed up with said bad products.)
    • beanjuiceII 1y ago
      is there an OSS solution that comes remotely close to dexcom g7 + omnipod 5? I haven't seen it, and we've been through many options. so i'm not sure what is 'suboptimal'
• marcosdumay 1y ago
  IMO, we should be demanding more from the banks and governments, not that they keep android open. We should demand that they support every platform. Or at least every platform that adopts some sandboxing model.
• utopiah 1y ago
  Yes and to be honest it's not necessarily unjustified BUT it should ONLY be done when the parts, hardware, software, or both, are not linked to a single proprietary actor. Need security before doing a $1000 transaction because everything so far was $10? Sure, ask for a physical token 2FA, NOT a YubiKey implementation. Obviously though if I was working at Google or Apple and paid for the success of my company via incentives, e.g. stock, I would fight tooth and nail to let banks know that only MY solution is secure.
• SergeAx 1y ago
  The web is an open platform, and most, if not all, aforementioned applications are happily working on the web.
  • TeMPOraL 1y ago
    Web being an open platform doesn't matter in any way, when the code runs on proprietary servers.
    • SergeAx 1y ago
      What prevents banks, etc, from doing the same with apps for open mobile OS?
• t_mann 1y ago
  Stupid question: couldn't we work around that with some VM/container-style solution? They could probably find ways to lock it down with TPM/TEE and similar, but in today's landscape it should be possible if you're willing to accept the performance and battery cost. And if it does get traction, there'll also be more push to keep open alternatives viable. Giving in without a fight is the only way to ensure you'll lose.
  • fsflover 1y ago
    Yes, some banking apps work on Waydroid.
• GuB-42 1y ago
  This is the reason I have given up on thinking of smartphones as general purpose computers. I used to root my phone on day one, play with custom ROMs, etc... But then, it became more and more annoying with apps blocking root access, features being unavailable to custom ROMs, etc... There are workarounds (is Magisk still a thing?), but I got tired of them. So now, I just buy an entry level Samsung, which is well supported, runs all the apps I need (browser, financial, maps, chat, ...) and takes recognizable pictures. It is just a boring tool, like a credit card, I need one because that's the world we live in, but the object itself is of no importance. If I want to play with a computer, I have a "real" computer. If, at some point, I get interested in smartphones as a platform, I will buy one just for this, in the same way that I have no intention of using the credit card I buy stuff with should I want to play with smartcards. It has also killed my desire to spend money on a smartphone. What's the point of a $1000 device? What's to point of upgrading unless forced to by planned obsolescence? Why should I pay more than $200 every 5 year or so? They are all the same to me. They even all have the same form factor, besides overpriced and fragile foldables.
• phendrenad2 1y ago
  And yet I can open my bank's website on my Linux desktop, using Firefox. The "players" are not all-powerful, and defeatism serves no one.
  • TeMPOraL 1y ago
    Yes, but what do you use as a second factor to authenticate and confirm money transfers? In large parts of the world, the answer is usually "my uprooted, remotely attested smartphone". Increasingly, it's becoming the only supported method. When that's the case, what you use to load the banking UI doesn't matter anymore - the mobile device is the only actual requirement.
    • phendrenad2 1y ago
      No, I use a dumb phone. Do you have anything more to say?
• panta 1y ago
  that's true only for as long as we allow that to be true. Users can live without Spotify (to cite just one representative of the mentioned categories), but Spotify can't live without users. We could (and should) stop behaving as powerless victims.
  • TeMPOraL 1y ago
    Good luck convincing anyone of that. We could also live without clothes and fancy food and most of modern amenities, but we don't, for the same reason.
• EchoReflection 1y ago
  I think, even though the ideas aren't "perfect"/"complete", Nietzche's "Will to Power" does a pretty good job of explaining "why" animals/ideologies/organizations/systems "unfold" the way they do. Everything (mostly) tries to protect/strengthen/replicate itself.(viruses being the most obvious example) https://www.gutenberg.org/files/52915/52915-h/52915-h.htm https://www.gutenberg.org/files/52915/52915-h/52915-h.htm
• txrx0000 1y ago
  It's not that an open platform can't succeed, but rather people are accustomed to closed platforms, so more resources went into perfecting them. The aforementioned players pushing for control aren't invincible. Whether we can move to open platforms depends on the choices people make. I can choose to use a bank that allows me to access all of their online banking features via the browser. I can choose to work for a company that doesn't want to surveil my personal device. I can deal with the government via snail mail, or in the browser. I can use third-party YouTube clients and torrent movies and games, or simply don't engage with DRM'd media because there's plenty of entertainment out there. Count the percentage of software you use that are open-source compared to 10 years ago. I bet it's more. It's only a matter of time before we make hardware open-source, too. When the mainstream is evil, being an outcast is the right thing to do. Every big change begins as a small movement.
  • TeMPOraL 1y ago
    > I can choose to use a bank that allows me to access all of their online banking features via the browser. Lucky you. There are fewer and fewer such banks out there. The trend is to route login and consequential interactions on the web through 2FA on a phone - and not TOTP, but push notifications sent to the bank's app, that only runs on devices that pass remote attestation checks. > I can choose to work for a company that doesn't want to surveil my personal device. Again, lucky you. Most people don't really get many options for employment at any given moment, and the issue of corporate phones is usually at the bottom of the list of criteria when one is looking for a job. I.e. not a real choice for most people. > I can deal with the government via snail mail At a snail pace. > or in the browser. Modern government systems around the world tend to require some sort of identification that usually gets tied to your smartphone, either directly or via your bank. > I can use third-party YouTube clients and torrent movies and games, or simply don't engage with DRM'd media because there's plenty of entertainment out there. Torrents aside, that's not the case. Entertainment isn't fungible. Disney can release all Star Wars media DRM-free for everyone to download, and it means exactly zero to someone who wants to watch Star Trek, but Paramount/CBS decided to go all Ferengi on the franchise. Can't substitute one for the other. This is why the market supports so many streaming services these days - they exploit this very fact. > Count the percentage of software you use that are open-source compared to 10 years ago. I bet it's more. Open Source software stopped mattering once the world embraced Software as a Service model. Source code on Github means nothing if the code is actually executed on servers you don't control and have no visibility into. That covers end-user OSS. The larger space of OSS building blocks are... building blocks. OSS libraries matter to users just as much as standard Phillips screws used inside an appliance, when they're beneath layers of glue and permanently soldered elements and join together elements explicitly labeled as "not end-user servicable". > It's only a matter of time before we make hardware open-source, too. That time will come around when we build a Star Trek-style replicator (and then have a successful revolution to seize this new means to production, because no way the first company to build an universal manufacturing device is going to just let people use it). Open Source Software succeeded only because software development has near-zero natural barrier to entry, so there was a large supply of bored high-schoolers and students, hobbyists, academics and other do-gooders with enough time and will to just build stuff and give it away for free. This isn't true for hardware. Now, circling back to the main point: > Whether we can move to open platforms depends on the choices people make. No, it does not. On consumer side, the market is driven by supply, not demand. I.e. you only get to choose from what the vendors decide to make available to you, and they know perfectly well you have to choose something, so your voice doesn't matter. If it did, we wouldn't be having this whole thread in the first place.
• drnick1 1y ago
  > Answer: bank/financial apps, enterprise apps, government apps and copyrighted media (music, video, games, books, ...). The only real issue here is banks that don't offer an equivalent website or require the "app" as authentication factor. I couldn't care less about copyrighted media. It's only fair that I source my media from the high seas when the only options that respect their "rights" infringe my own right to run free software on my devices.
  • TeMPOraL 1y ago
    The key thing isn't that the banks (and governments, and enterprise software vendors, and ...) don't provide an alternative to the app as authentication factor. It's why they don't do this. It's not about security. It's about them wanting people to use the apps. Forcing everyone to use an app streamlines the vendors' operations, reduces the state space of possible user interactions down to small number of flows they control directly, and also provides them a direct channel (communications or upsell, where applicable) to the user. This is not a fluke or a conspiracy of small number of influential players. It's an emergent alignment of incentives across pretty much the whole supply side of digital aspect of human civilization (not "just" the market, because it's also happening in political and social spheres).
• kuhsaft 1y ago
  I would add that end-users are OK with this because they expect their devices to not be compromised when installing an app. The majority of users are OK with trusted computing and are OK with trusting Google, Apple, Microsoft because it’s easier to trust one of those companies than having to trust each app developer. In the end, you have to trust someone and it’s better if that someone can be held accountable by some legal system.
  • troyvit 1y ago
    I agree. I also think though that it's a different kind of trust. They trust Google, Apple, and Microsoft because they _think_ they'll be held accountable by some legal system, but judging by the wrist slaps meted out for their massive security lapses (especially you M$) or their constant breakage of their own privacy policies to spy on people it actually seems worse than trusting individual app developers.
• troyvit 1y ago
  > Those are the players that demand excessive control over end-user devices, and thus the ultimate driver behind the problem we're discussing. But they don't demand the same control over laptops and desktops. Only phones. Why is that? Granted I can't deposit a check with my laptop but I can do any other banking I wish to do. So to me it's more that they see the chance to gain this control where they didn't see it before. Phone providers are only too happy to get on that bandwagon because they get to deploy all kinds of surveillance capitalism in the name of security ("hey the banks want it!"). Granted these freedoms are slowly leaching away from laptops and desktop too with stuff like TPM, so I don't know. I've about had it though.
  • TeMPOraL 1y ago
    > But they don't demand the same control over laptops and desktops. Only phones. Why is that? Oh, but they do. PCs (and Macbooks) are products of an earlier era, and the solutions of control evolved along; it looks chaotic, but that's because it's where the R&D happened over the past decades, which ultimately produced a cleaner - and more easily identifiable - mobile control ecosystem. But it's all there, if you look closely. To name few major groups: - Many generations of DRM plugins for games, then for streaming media - Trusted computing hardware - Intel Management Engine and other firmware backdoors routinely inserted into hardware - Endpoint security software, deployed widely on corporate-owned machines Mobile solutions are just version 2.0, built on top of all that R&D. > Granted I can't deposit a check with my laptop but I can do any other banking I wish to do. This is the insidious part: for many banks, this is only tolerated because they force you to use their proprietary app on a trusted mobile device as a second factor! At this point, it doesn't really matter how well-controlled your main browsing platform is, because you have to use your phone anyway, and there the control happens. And, "for your convenience", the mobile app isn't just a physical security token, but lets you do banking too, which allows them to gradually deprecate the web experience.
  • bitwize 1y ago
    Apple is already in the process of closing down the Mac. As for PCs... why do you think these hardware requirements were imposed on Windows 11? Hint: When Windows 12 comes out, everyone, or at least everyone with a newish PC, will have a TPM module that's capable of enforcing and attesting a signed-code boot path from power on all the way down to application-level code. Windows 12 will turn these machines into Xboxes that run Excel. Many computers will also have Pluton technology, which is an on-chip TPM implementation that cannot be tampered with or removed from the CPU, and which literally came from Microsoft's Xbox division. General purpose computing isn't quite dead yet, but there's really nothing we can do for the patient. We're just waiting for it to flatline.
• krzyk 1y ago
  And yet Linux and to lesser extent Windows and even lesser macos exist. They don't have that excessive control and we still can use bank/financial goverment and (if we enable DRM) also copyrighted media webpages (and sometimes apps). Aside from music/video there are no obstacles for other apps to exist in open system.
• oytis 1y ago
  Yeah, I would absolutely get rid of my smartphone if I could do banking and all the numerous authentication processes without it. While I sympathise with all the Linux phone projects, I just don't have a use case for a Linux phone.