5 ms·

As much as the move is annoying and alienating for the tech-savvy (the same market Barclays are trying to embrace), I can see some logic behind the decision. T

As much as the move is annoying and alienating for the tech-savvy (the same market Barclays are trying to embrace), I can see some logic behind the decision. The type of person who roots their phone is almost always going to be technologically experienced, or at least idea of dealing with money through technology. On the other hand, though, Pingit is new technology and is actually scary for some people. When I enabled it in-branch, the advisor was surprised - even she said she'd never trust it! I imagine that internally for Barclays it's a big move and a sensitive one. A security breach in the early stages would be catastrophic for the service and their brand. They need security, and for that they need stability. A rooted phone is not a stable environment for Barclays to run their software - it could have been changed in any number of ways. It's a logical decision for them to increase stability by removing the wildcard platforms where they can't be sure what's going on.

darklajid 12y ago
What's the threat here? A bad impression because apps might crash on rooted phones? Because that's the only explanation I would buy. Security? I highly doubt that this can be an issue here and I cannot follow that logic of yours, to be honest.
Drakim 12y ago
> I imagine that internally for Barclays it's a big move and a sensitive one. A security breach in the early stages would be catastrophic... > A rooted phone is not a stable environment for Barclays to run their software - it could have been changed in any number of ways This means it could be less stable, but I don't see how it would affect the possibility of a "security breach". You are talking about two different kind of issues as if they are related. Could you clarify?
- onion2k 12y ago
  By definition a rooted phone is compromised - a user has obtained root level privileged access. That's what 'rooted' means. The assumption is that it's the phone owner's actions that caused that to happen, but that's not necessarily the case. A third party could have rooted it. A local app exploit could have rooted it. Some clever malware that hasn't even been written yet that somehow escaped Android's security sandbox could have done it. Ordinarily no one would care if a phone has been rooted or not. It's not important. But the point here is that allowing an app that has access to your bank account to run on a rooted device is assuming that the device was intentionally rooted by it's owner. For a bank that should be assuming far too much.
  - viraptor 12y ago
    Actually they can only check for actual user-exposed way of rooting the phone. If there's a way some local app can do it, it doesn't have to expose this functionality - it can do whatever it wants to with it's elevated privileges and not leave a trace behind. Local app exploit that messes with the bank app only will not be detectable by the bank app.
  - icebraining 12y ago
    There's no reason for a clever malware to root your phone. "Rooting" only makes sense if you want to replace 'su' to grant root to different apps. If a malware escalates to root, it can just do whatever it wants, it doesn't have to "root". Besides, even if the malware really needed to "root" the device, it could just use the same process has RootCloak[1] to hide that fact. There's no valid security explanation; the app must designed assuming it's running on an insecure system, because there's no way of knowing if the system isn't lying. [1] http://repo.xposed.info/module/com.devadvance.rootcloak http://repo.xposed.info/module/com.devadvance.rootcloak
  - e40 12y ago
    A third party could have rooted it. This seem highly unlikely. In fact, I've never heard of it. And, add to that the serious hurdles I had to go through to root all the phones I ever rooted (3). Your statements amount, to me, to overblown risk.
- esquivalience 12y ago
  Sorry, sloppy language. I didn't mean stability in the normal sense - rather, homogeneity of the OS. I think that is connected to security: a rooted OS is more likely than a vanilla OS to cause software to run less predictably (probably mostly deliberate). This creates a definite security risk, and one that will be especially feared by a bank where confidence in its brand is at risk.
johnpmayer 12y ago
Barclays surely has a web app; not sure how a rooted phone is any more unstable/unknown than HTML/Javascript running on an unknown browser client.
personZ 12y ago
The type of person who roots their phone is almost always going to be technologically experienced Unfortunately, it seems, the opposite is true: Rooting is often one of the "checklist" kind of things that you see on many misled Android forums, and it seems that many users do it...just because. And now they have a platform that is often significantly more vulnerable. I completely understand why services would block this -- it fundamentally breaks the protections of the device. Many widely referenced vulnerabilities of Android only apply to rooted devices.
- aianus 12y ago
  How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.
  - lutusp 12y ago
    The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.
  - personZ 12y ago
    it's the direct equivalent of UAC on Windows or sudo access on Linux Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.
    - 12y ago

darklajid 12y ago

What's the threat here? A bad impression because apps might crash on rooted phones? Because that's the only explanation I would buy. Security? I highly doubt that this can be an issue here and I cannot follow that logic of yours, to be honest.

Drakim 12y ago

> I imagine that internally for Barclays it's a big move and a sensitive one. A security breach in the early stages would be catastrophic... > A rooted phone is not a stable environment for Barclays to run their software - it could have been changed in any number of ways This means it could be less stable, but I don't see how it would affect the possibility of a "security breach". You are talking about two different kind of issues as if they are related. Could you clarify?

onion2k 12y ago
By definition a rooted phone is compromised - a user has obtained root level privileged access. That's what 'rooted' means. The assumption is that it's the phone owner's actions that caused that to happen, but that's not necessarily the case. A third party could have rooted it. A local app exploit could have rooted it. Some clever malware that hasn't even been written yet that somehow escaped Android's security sandbox could have done it. Ordinarily no one would care if a phone has been rooted or not. It's not important. But the point here is that allowing an app that has access to your bank account to run on a rooted device is assuming that the device was intentionally rooted by it's owner. For a bank that should be assuming far too much.
- viraptor 12y ago
  Actually they can only check for actual user-exposed way of rooting the phone. If there's a way some local app can do it, it doesn't have to expose this functionality - it can do whatever it wants to with it's elevated privileges and not leave a trace behind. Local app exploit that messes with the bank app only will not be detectable by the bank app.
- icebraining 12y ago
  There's no reason for a clever malware to root your phone. "Rooting" only makes sense if you want to replace 'su' to grant root to different apps. If a malware escalates to root, it can just do whatever it wants, it doesn't have to "root". Besides, even if the malware really needed to "root" the device, it could just use the same process has RootCloak[1] to hide that fact. There's no valid security explanation; the app must designed assuming it's running on an insecure system, because there's no way of knowing if the system isn't lying. [1] http://repo.xposed.info/module/com.devadvance.rootcloak http://repo.xposed.info/module/com.devadvance.rootcloak
- e40 12y ago
  A third party could have rooted it. This seem highly unlikely. In fact, I've never heard of it. And, add to that the serious hurdles I had to go through to root all the phones I ever rooted (3). Your statements amount, to me, to overblown risk.
esquivalience 12y ago
Sorry, sloppy language. I didn't mean stability in the normal sense - rather, homogeneity of the OS. I think that is connected to security: a rooted OS is more likely than a vanilla OS to cause software to run less predictably (probably mostly deliberate). This creates a definite security risk, and one that will be especially feared by a bank where confidence in its brand is at risk.

johnpmayer 12y ago

Barclays surely has a web app; not sure how a rooted phone is any more unstable/unknown than HTML/Javascript running on an unknown browser client.

personZ 12y ago

The type of person who roots their phone is almost always going to be technologically experienced Unfortunately, it seems, the opposite is true: Rooting is often one of the "checklist" kind of things that you see on many misled Android forums, and it seems that many users do it...just because. And now they have a platform that is often significantly more vulnerable. I completely understand why services would block this -- it fundamentally breaks the protections of the device. Many widely referenced vulnerabilities of Android only apply to rooted devices.

aianus 12y ago
How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.
- lutusp 12y ago
  The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.
- personZ 12y ago
  it's the direct equivalent of UAC on Windows or sudo access on Linux Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.
  - 12y ago