Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

81–90 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#81

Post by SketchySeaBeast »

roughly wrote: post #59
rixthefox wrote: post #14

Earlier quoted context omitted.

In this economy? /s The other more compelling reason why people would have a rooted phone is to run ROMs that may still be providing OS support where the stock OS has been abandoned or EOL'd by the developer. Having an unlocked bootloader at the minimum would be required in those scenarios. It actually saves hardware that still works from ending up in landfills. edit: spelling

The first time I walked past a homeless person on a smart phone it took a minute to process - phones are effectively free at this point. (The first time I walked past a homeless person using a VR headset, on the other hand, was a fucking trip.)

That sounds like a Silicon Valley bit.

Re: The Vietnam government has banned rooted phones from using any banking app

#82

Post by Fiveplus »

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy?

The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own hardware. The genius of the modders in that XDA thread is undeniable, but they are fighting a war against the fundamental architecture of modern trust and the architecture is winning.

Re: The Vietnam government has banned rooted phones from using any banking app

#84

Post by zb3 »

Google is to blame, they're abusing device security by preloading their unremovable spyware with elevated privileges.. people then want to remove it but then find themselves unable to use banking apps because of this.

I'm not against having a separate secure phone to use with banking apps, but that phone must be designed for security, not for Google's ad driven business model..

Re: The Vietnam government has banned rooted phones from using any banking app

#85

Post by jdiff »

ljm wrote: post #78
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Depends on what country you're in. In the UK, the banks are often held liable for various scams that involve the transfer of money, so they up the security over and over again. A bank will rightly argue why it's responsible for an old granny sending her life savings to her new lover in Namibia, so it seeks to block that transaction in the first place. Some of that liability is fair but most of it is the government te…

Rooted devices don't enable that transaction. That's all social engineering.

Re: The Vietnam government has banned rooted phones from using any banking app

#86

Post by TZubiri »

jamesnorden wrote: post #24
memoriuaysj wrote: post #16

Earlier quoted context omitted.

the banks would care. less money spent on security or dealing with clients who had their money stolen

Are you implying there's a big percentage of people getting their money stolen because they rooted their phones? I'd like to see some data on that if so.

I think the point is that phone apps are more secure than, for example, web apps.

Users that try to use mobile apps as if they were web apps, disabling location, and security features are just flagged by numerous security mechanisms.

Re: The Vietnam government has banned rooted phones from using any banking app

#87

Post by lenerdenator »

bugbuddy wrote: post #74
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

This is a very condescending toward Vietnamese tech people. According to Twitter/X, Vietnam’s GDP just surpassed Thailand and it’s on its way to joining the Great East Asian prosperity zone by becoming the last country to become fully industrialized and very rich. Many tech jobs in the US will move to Vietnam in the coming few years. You will be surprised where your future Tech conferences will be located.

You're on the money with the rest of this, but...

> Many tech jobs in the US will move to Vietnam in the coming few years.

It would seem to me that India has that on lock.

Re: The Vietnam government has banned rooted phones from using any banking app

#88

Post by seanmcdirmid »

cons0le wrote: post #65
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Yep, hardware attestation is becomming more common, even with websites. This is why LineageOS is actually dead in the water, even though they're "in talks with hardware vendors". It doesn't matter when people can't use the apps and services they need.

This reminds me when living in South Korea used to require Internet Explorer/ActiveX to get anything done online:

https://en.wikipedia.org/wiki/Web_compatibility_issues_in_So...

Re: The Vietnam government has banned rooted phones from using any banking app

#89

Post by hackyhacky »

edent wrote: post #49
wdrw wrote: post #23

Earlier quoted context omitted.

Dependence on a secure client is generally a bad idea. Security should be server-side.

This isn't about the bank's security - it is about the users'. Users are losing billions worldwide due to fraudulent apps. If a user has root and runs a malicious app, it can intercept what a legitimate banking app does. A scam app with root can draw over the screen and tell users to transfer money, or it can run a series of actions when the banking app is running, or do any of a hundred things to steal money.

> A scam app with root

Sure. But the people who are actually rooting their phones are advanced users and aren't going to install a malicious custom OS. Are naive users getting tricked into rooting their own phones? I'm dubious what the security benefit is of this decision.

Re: The Vietnam government has banned rooted phones from using any banking app

#90

Post by treyd »

NiloCK wrote: post #40
taosx wrote: post #5

I really don't understand this. My line of thinking is that if someone is technical enough to root his phone he understands the risks. Why would they force banking apps to detect and not work on rooted phones? Why would the government care so much?

A rooted phone is more capable of modifying the banking app itself and has 'freer reign' over the APIs that the app uses to interact with the bank. Whereas previously the app displays a 'whitelisted' set of UI options to the user, the rooted user could use employee only methods. Somewhere or other every bank has methods that set balances on accounts. To be honest a law like this makes security by the extremely modest…

> the rooted user could use employee only methods. Somewhere or other every bank has methods that set balances on accounts.

Exposing these types of APIs in any way outside the bank ever would be gross negligence.

Post reply on HN