5 ms·
There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of
by tux3 9mo ago
There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app.
Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful.
Anyways, they're not yet at the point where they've learned to do the checks server-side. For now it's a one line patch to skip the root screen. But the Play Integrity API is designed correctly, if they learn to use it, there will be no workaround without someone finding a hardware vulnerability somewhere.
- cons0le 9mo agoYep, hardware attestation is becomming more common, even with websites. This is why LineageOS is actually dead in the water, even though they're "in talks with hardware vendors". It doesn't matter when people can't use the apps and services they need.
- hyghjiyhu 9mo agoA solution could be having a tiny non-rooted Android system as a "coprocessor".
- ExpertAdvisor01 9mo agoThis won't work. The tiny non-rooted system wouldn't get certified by Google and therefore not pass hardware attestation, which most banking apps use.
- NoGravitas 9mo agoI think they mean having a second non-rooted phone that is certified but cheap.
- hyghjiyhu 9mo agoWell you could take a certified system off-the-shelf and integrate it into a bigger thing.
- seanmcdirmid 9mo agoThis reminds me when living in South Korea used to require Internet Explorer/ActiveX to get anything done online: https://en.wikipedia.org/wiki/Web_compatibility_issues_in_South_Korea https://en.wikipedia.org/wiki/Web_compatibility_issues_in_So...
- bugbuddy 9mo agoThis is a very condescending toward Vietnamese tech people. According to Twitter/X, Vietnam’s GDP just surpassed Thailand and it’s on its way to joining the Great East Asian prosperity zone by becoming the last country to become fully industrialized and very rich. Many tech jobs in the US will move to Vietnam in the coming few years. You will be surprised where your future Tech conferences will be located.
- lenerdenator 9mo agoYou're on the money with the rest of this, but... > Many tech jobs in the US will move to Vietnam in the coming few years. It would seem to me that India has that on lock.
- adrr 9mo agoBunch of fintechs only let your signup from an app. Easier to secure and prevent bots. Pin certs, detect virtualization, etc.
- lenerdenator 9mo agoAnd, of course, easier to get the valuable data about the person setting up an account.
- adrr 9mo agoLike what data? Curious because I built and launched a challenger bank.
- lenerdenator 9mo agoTheoretically any sort of data that apps in a given OS can access through an API.
- Ritewut 9mo agoWhat app developers find most valuable is what other apps you use and what competitors apps you have so they can target you more effectively. If you have Peloton or Tonal, they want to know if you have the Strava app on your phone for example.
- adrr 9mo agoOnly on older versions of Android. Apps are very locked down on what you can get. I would have loved to be able to fingerprint a device when i was at the challenger bank and application list is very good for fingerprinting.. We would fingerprint on the web to detect bots.
- itsgabriel 9mo agoDid you know about this workaround? Afaik it's still active https://peabee.substack.com/p/everyone-knows-what-apps-you-use https://peabee.substack.com/p/everyone-knows-what-apps-you-u...
- ljm 9mo agoDepends on what country you're in. In the UK, the banks are often held liable for various scams that involve the transfer of money, so they up the security over and over again. A bank will rightly argue why it's responsible for an old granny sending her life savings to her new lover in Namibia, so it seeks to block that transaction in the first place. Some of that liability is fair but most of it is the government telling the banks to account for the loss when someone is scammed. They are obviously going to mitigate that as much as they can.
- jdiff 9mo agoRooted devices don't enable that transaction. That's all social engineering.
- jack_pp 9mo agoand grandmas don't root their devices.
- pixl97 9mo agoAs a devils advocate grandma would have no idea if she was buying or got her device rooted by someone else.
- mike_hearn 9mo agoIt's all social engineering now but that's because phones are secure and remote attestation infrastructure is in place. Go back fifteen years and malware is absolutely submitting bank transactions after the user does a 2FA. https://krebsonsecurity.com/2010/03/crooks-crank-up-volume-of-e-banking-attacks/ https://krebsonsecurity.com/2010/03/crooks-crank-up-volume-o...
- themafia 9mo ago> so they up the security They're upping the surveillance, not the security, quite demonstrably. This is meant to protect /them/ from liability and not /you/ from loss.
- al_borland 9mo agoThis trend makes me want to find a small town credit union. I chose my current bank because it was one of the few that had proper token based access for 3rd party integration. An overwhelming majority of banks were relying on a 3rd party holding your actual username/password and saying "trust me bro". I wasn't comfortable with that.
- Ritewut 9mo agoI use a small town credit union and its great.
- jacobthesnakob 9mo agoNormiefication. Normies do everything on their phones; it’s the companies meeting the masses where they are. I’ve seen people fight for their lives to do a spreadsheet on their phones when there’s a laptop they own gathering dust less than 50 feet away.
- fuzzzerd 9mo agoThis term needs to catch on, this is the first I've seen it, bit it explains why so many prodict decisions are made and those who know better/different are just too small a minority to get any say. We're dragged into this kicking and screaming and yet normies think we're the crazy ones.
- nitwit005 9mo agoPossibly, but companies seem strangely set on getting people to install apps, even when the feedback is negative. Offering a monetary reward for installing apps seems fairly common. Chevron had someone at my gas station offering something like $5 of free gas, plus $1 a gallon off of the next three purchases. If it was something the customers wanted, they wouldn't need to pay people to do it.