3 ms·

How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of

by aianus 12y ago

How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.

lutusp 12y ago
The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.
personZ 12y ago
it's the direct equivalent of UAC on Windows or sudo access on Linux Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.
- aianus 12y ago
  It's none of their business if I do or don't have admin access on my computer. If Barclays came out and said their website would only work on locked-down Chromebooks we'd all recognize it as absurd. It's actually kind of scary how brainwashed we've been in the mobile era into accepting this sort of thing as normal.
ultrafez 12y ago
The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.

by aianus 12y ago

lutusp 12y ago

The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.

personZ 12y ago

it's the direct equivalent of UAC on Windows or sudo access on Linux Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.

aianus 12y ago
It's none of their business if I do or don't have admin access on my computer. If Barclays came out and said their website would only work on locked-down Chromebooks we'd all recognize it as absurd. It's actually kind of scary how brainwashed we've been in the mobile era into accepting this sort of thing as normal.

ultrafez 12y ago

The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.