4 ms·

The type of person who roots their phone is almost always going to be technologically experienced Unfortunately, it seems, the opposite is true: Rooting is oft

by personZ 12y ago

The type of person who roots their phone is almost always going to be technologically experienced Unfortunately, it seems, the opposite is true: Rooting is often one of the "checklist" kind of things that you see on many misled Android forums, and it seems that many users do it...just because. And now they have a platform that is often significantly more vulnerable. I completely understand why services would block this -- it fundamentally breaks the protections of the device. Many widely referenced vulnerabilities of Android only apply to rooted devices.

aianus 12y ago
How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.
- lutusp 12y ago
  The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.
- personZ 12y ago
  it's the direct equivalent of UAC on Windows or sudo access on Linux Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.
  - aianus 12y ago
    It's none of their business if I do or don't have admin access on my computer. If Barclays came out and said their website would only work on locked-down Chromebooks we'd all recognize it as absurd. It's actually kind of scary how brainwashed we've been in the mobile era into accepting this sort of thing as normal.
- ultrafez 12y ago
  The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.

by personZ 12y ago

aianus 12y ago

How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.

lutusp 12y ago
The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.
personZ 12y ago
it's the direct equivalent of UAC on Windows or sudo access on Linux Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.
- aianus 12y ago
  It's none of their business if I do or don't have admin access on my computer. If Barclays came out and said their website would only work on locked-down Chromebooks we'd all recognize it as absurd. It's actually kind of scary how brainwashed we've been in the mobile era into accepting this sort of thing as normal.
ultrafez 12y ago
The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.