3 ms·

Isn't that what happens in Europe with most rooted phones and banks too? At least I can remember my banking apps stopped working.

deleted 9mo ago
[deleted]
elric 9mo ago
There's no laws banning this in any European countries that I'm aware of, except maybe Hungary? It's just banks being stupid, consumer-hostile, and anti-competitive.
- Aspos 9mo ago
  Well, I've built a bunch of mobile banking apps and we did detect if the phone was rooted, was in dev mode, etc. and it is not because we were "stupid, consumer-hostile, and anti-competitive". If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. There is no way to store customer's secrets in a PC browser securely, so all the "dangerous" transactions were outright prohibited in the web app or made available only via temporary QR login. All this is just is a negative side effect of customer protection laws.
  - abdullahkhalids 9mo ago
    Why don't banks just make desktop computer applications?
    - Aspos 9mo ago
      Practically impossible to store secrets in a desktop app too. Besides, customers would not willing to install a desktop app. And those who would, will require support.
    - mike_hearn 9mo ago
      PC platforms don't have remote attestation infrastructure working.
      - elric 9mo ago
        And surprisingly I can pay securely using my PC, fully rooted, on FOSS software. Hardware tokens have been a thing for decades. There are more second (or third) factor authentication and signing solutions than I can enumerate. Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.
        Magnusmaster 9mo ago
        Most banks don't know hardware tokens are a thing. They want everyone to use their app.
        elric 9mo ago
        Is this yet more evidence of how utterly broken US banks are? Assuming you are referring to US banks. For the past 20 or so years, every bank I've been with in Belgium has provided me with one of three types of hardware token: 1. An OTP token that's just a screen that displays a new 6 digit token every couple of seconds (haven't seen one of these in a few years now). This was used to supplement username/password on login and to verify every bank transfer. 2. A token with a screen and a display, which generates OTPs based on input. E.g. for a payment the bank would tell me to enter the amount + the last N digits of the bank account, the token then generates an OTP, which I can use to confirm the payment. That's what 2 of my 3 banks currently use. They have separate modes for logging in, for signing bank transfers, for signing 3D Secure online payments, etc. 3. A card reader where where I just slot in my card. I can then log in or sign payments using the card's chip & pin. This is what my third bank uses. There are a couple of variants on this, such as models which connect with USB and models which can read QR codes from your screen so you don't have to tap in anything except for your PIN.
        mike_hearn 9mo ago
        The hardware token is itself a form of remote attestation. The reason you need extra hardware is because the PC can't do it.
    - elric 9mo ago
      They used to, and some still kind of do, but no longer for consumers.
  - izacus 9mo ago
    > If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. Now that's just not true now, is it? Sure the lawyers told you that (the ones that get paid to tell you that), but nowhere in EU was a bank actually fined for not root checking a device. They were plenty fined by being utterly incompetent with security practices and doing them poorly - like trying to inject wierd .SOs to do the root detection you're defending.
    - mike_hearn 9mo ago
      Literally three days ago: https://www.complianceweek.com/regulatory-policy/eu-agrees-rules-to-make-payment-providers-and-online-platforms-liable-for-customer-fraud-losses/36408.article https://www.complianceweek.com/regulatory-policy/eu-agrees-r... "Payment service providers (PSPs) operating in the EU will have to cover customers’ losses from fraud if their fraud protection regimes are inadequate or poorly implemented under new EU rules." Other places like the UK had such rules already.
      - izacus 9mo ago
        Note how this says nothing about root lockout. The fact that no root lockout means "inadequate protection" is something you projected onto this statement and that's the part I'm addressing in my comment. No one actually got fined for root protection specifically.
        mike_hearn 9mo ago
        Regulators love vague standards like "inadequate protection" because it means they can implement a ratchet effect without needing to understand anything or constantly rewrite the laws. If someone gets hurt they just look around at whatever the competition is doing, pick the most extreme thing, and declare that any other standard is inadequate. So sure, if you want to not use security tactics your competitors are using and then try to lawyer out of it by arguing, "it didn't specifically say we had to do that" in front of the EU Commission, go ahead. But don't blame the banks that are more realistic about how this works.
  - elric 9mo ago
    These practices are strengthening the Google/Apple hegemony and are ultimately damaging user freedoms and consumer protections. I'm sure that's not your employer's intention, but it is a negative thing that they're contributing to. And because of how essential banking is, banks have a big thumb on this particular scale, and I wish they'd use it for good rathet than for enriching and entrenching evil.
  - Zak 9mo ago
    I understand (but vehemently oppose) the argument for root detection. What risks to banks see from having developer settings enabled?
  - realusername 9mo ago
    Great, so the no-name iPhone clone in China passes your test but EOS doesn't. There's no way to assess the security of a rom from an app and it's about time that banks learn this reality. Software on mobile is even more fragmented and less standardized than on desktop
ExpertAdvisor01 9mo ago
Most banking apps use a third party security solution . They then often implement Google play integrity .

deleted 9mo ago

[deleted]

elric 9mo ago

There's no laws banning this in any European countries that I'm aware of, except maybe Hungary? It's just banks being stupid, consumer-hostile, and anti-competitive.

Aspos 9mo ago
Well, I've built a bunch of mobile banking apps and we did detect if the phone was rooted, was in dev mode, etc. and it is not because we were "stupid, consumer-hostile, and anti-competitive". If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. There is no way to store customer's secrets in a PC browser securely, so all the "dangerous" transactions were outright prohibited in the web app or made available only via temporary QR login. All this is just is a negative side effect of customer protection laws.
- abdullahkhalids 9mo ago
  Why don't banks just make desktop computer applications?
  - Aspos 9mo ago
    Practically impossible to store secrets in a desktop app too. Besides, customers would not willing to install a desktop app. And those who would, will require support.
  - mike_hearn 9mo ago
    PC platforms don't have remote attestation infrastructure working.
    - elric 9mo ago
      And surprisingly I can pay securely using my PC, fully rooted, on FOSS software. Hardware tokens have been a thing for decades. There are more second (or third) factor authentication and signing solutions than I can enumerate. Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.
      - Magnusmaster 9mo ago
        Most banks don't know hardware tokens are a thing. They want everyone to use their app.
        elric 9mo ago
        Is this yet more evidence of how utterly broken US banks are? Assuming you are referring to US banks. For the past 20 or so years, every bank I've been with in Belgium has provided me with one of three types of hardware token: 1. An OTP token that's just a screen that displays a new 6 digit token every couple of seconds (haven't seen one of these in a few years now). This was used to supplement username/password on login and to verify every bank transfer. 2. A token with a screen and a display, which generates OTPs based on input. E.g. for a payment the bank would tell me to enter the amount + the last N digits of the bank account, the token then generates an OTP, which I can use to confirm the payment. That's what 2 of my 3 banks currently use. They have separate modes for logging in, for signing bank transfers, for signing 3D Secure online payments, etc. 3. A card reader where where I just slot in my card. I can then log in or sign payments using the card's chip & pin. This is what my third bank uses. There are a couple of variants on this, such as models which connect with USB and models which can read QR codes from your screen so you don't have to tap in anything except for your PIN.
      - mike_hearn 9mo ago
        The hardware token is itself a form of remote attestation. The reason you need extra hardware is because the PC can't do it.
  - elric 9mo ago
    They used to, and some still kind of do, but no longer for consumers.
- izacus 9mo ago
  > If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. Now that's just not true now, is it? Sure the lawyers told you that (the ones that get paid to tell you that), but nowhere in EU was a bank actually fined for not root checking a device. They were plenty fined by being utterly incompetent with security practices and doing them poorly - like trying to inject wierd .SOs to do the root detection you're defending.
  - mike_hearn 9mo ago
    Literally three days ago: https://www.complianceweek.com/regulatory-policy/eu-agrees-rules-to-make-payment-providers-and-online-platforms-liable-for-customer-fraud-losses/36408.article https://www.complianceweek.com/regulatory-policy/eu-agrees-r... "Payment service providers (PSPs) operating in the EU will have to cover customers’ losses from fraud if their fraud protection regimes are inadequate or poorly implemented under new EU rules." Other places like the UK had such rules already.
    - izacus 9mo ago
      Note how this says nothing about root lockout. The fact that no root lockout means "inadequate protection" is something you projected onto this statement and that's the part I'm addressing in my comment. No one actually got fined for root protection specifically.
      - mike_hearn 9mo ago
        Regulators love vague standards like "inadequate protection" because it means they can implement a ratchet effect without needing to understand anything or constantly rewrite the laws. If someone gets hurt they just look around at whatever the competition is doing, pick the most extreme thing, and declare that any other standard is inadequate. So sure, if you want to not use security tactics your competitors are using and then try to lawyer out of it by arguing, "it didn't specifically say we had to do that" in front of the EU Commission, go ahead. But don't blame the banks that are more realistic about how this works.
- elric 9mo ago
  These practices are strengthening the Google/Apple hegemony and are ultimately damaging user freedoms and consumer protections. I'm sure that's not your employer's intention, but it is a negative thing that they're contributing to. And because of how essential banking is, banks have a big thumb on this particular scale, and I wish they'd use it for good rathet than for enriching and entrenching evil.
- Zak 9mo ago
  I understand (but vehemently oppose) the argument for root detection. What risks to banks see from having developer settings enabled?
- realusername 9mo ago
  Great, so the no-name iPhone clone in China passes your test but EOS doesn't. There's no way to assess the security of a rom from an app and it's about time that banks learn this reality. Software on mobile is even more fragmented and less standardized than on desktop

ExpertAdvisor01 9mo ago

Most banking apps use a third party security solution . They then often implement Google play integrity .