Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

151–160 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#151

Post by everdrive »

jamesnorden wrote: post #24
memoriuaysj wrote: post #16

Earlier quoted context omitted.

the banks would care. less money spent on security or dealing with clients who had their money stolen

Are you implying there's a big percentage of people getting their money stolen because they rooted their phones? I'd like to see some data on that if so.

I don't know the reality, but my guess would be that it's the inverse of what you proposed; a significant portion of fraud cases identified by banks involved a rooted phone. From the defender's perspective, this could be a problem they run into over and over again, and take an outside place in their eyes.

Re: The Vietnam government has banned rooted phones from using any banking app

#152

Post by kube-system »

immibis wrote: post #68
SketchySeaBeast wrote: post #57

Earlier quoted context omitted.

Don't like that. I'm of the "if you're going to do something important, do it on your PC" generation. I do not want a future where I lose my phone and I can no longer access my bank.

Claim you don't have a phone, and they'll find a solution.

What is that supposed to accomplish? The service providers that require a phone will require one whether you have one or not.

Re: The Vietnam government has banned rooted phones from using any banking app

#153

Post by array_key_first »

Zak wrote: post #132
ecshafer wrote: post #119

When I used to work on the Vanguard authentication team, we blocked Vietnam from access because of too much fraud (not my choice). But it was funny because we had Vietnam based clients, so there were a couple HNW clients in the logs that you could see who would log in from Vietnam/Russia/Wherever, get blocked, open their vpn, then log in from England. This was a while back, but even then there was a push for things l…

I'd be really interested to know whether a significant amount of fraud and fraud attempts involve devices with root or non-stock operating systems. This has always struck me as a matter of checkbox compliance rather than a commonly-exploited attack vector, though I'll grant that's partially because few people actually use such devices.

Intuitively I'd say no, there's no way it's a significant amount of fraud. Number one because, as you said, it's rare, but number two because you just don't need a rooted phone to scam someone. You can very easily scam people on perfectly legitimate phones and with perfectly legitimate apps.

Re: The Vietnam government has banned rooted phones from using any banking app

#155

Post by [deleted] »

jjulius wrote: post #143
Helmut10001 wrote: post #106

Earlier quoted context omitted.

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

> By 2026, you'll need two phones... Need ? Unless and/or until the ability to log in and do your banking, healthcare, etc. via desktop/laptop goes away, then you don't need a phone to do any of that. Yes, 2FA may be required but in the tangential experience of myself, my partner and my two closest friends, we have multiple 2FA options available to us for our banking/healthcare apps that don't require a smartphone. I…

[deleted]

Re: The Vietnam government has banned rooted phones from using any banking app

#157

Post by anthk »

pwg wrote: post #118
Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

Cory Doctorow predicted this outcome back in 2011: The Coming War on General Purpose Computation https://boingboing.net/2011/12/27/the-coming-war-on-general-...

And Richard Stallman since 1983 and before.

Re: The Vietnam government has banned rooted phones from using any banking app

#158

Post by m4rtink »

Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

Are you sure it actually works ?

Outdated but signed ROM with tons of unfixed CVEs will be still considered totally fine.

Latets Lineage OS or Graphene OS will be rejected.

Re: The Vietnam government has banned rooted phones from using any banking app

#159

Post by tetris11 »

seszett wrote: post #135
Helmut10001 wrote: post #106

Earlier quoted context omitted.

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

That's what I do too (not iOS + GrapheneOS but the result is the same) as I was tired of fighting to make my bank apps and itsme (digital identity app in Belgium) work on my rooted phone. Everytime I have to use a stock phone I'm appalled at the ads and I have absolutely no trust in any US or Chinese manufacturer. So I use them only for banking and digital id because that's presumably not what they actually care abou…

My job's SSO moved to provider that either required an unrooted phone or a reliable Voice auth.

For 2 years the voice authentication worked fine (they call me, I type in a number) on my regular rooted phone. Then one random morning I just stopped getting the phone calls. "Network said no".

Complete lock out, nothing I could do except go out and panic-buy an unrooted phone not running Lineage and using a modern Android version. (I tried my older unofficial lineage phones without root, and no dice.)

I opted for a good phone I could postmarket later, but gosh did it set me back almost 1/5 of my monthly salary.

Re: The Vietnam government has banned rooted phones from using any banking app

#160

Post by NoGravitas »

dvngnt_ wrote: post #92
edent wrote: post #49

Earlier quoted context omitted.

This isn't about the bank's security - it is about the users'. Users are losing billions worldwide due to fraudulent apps. If a user has root and runs a malicious app, it can intercept what a legitimate banking app does. A scam app with root can draw over the screen and tell users to transfer money, or it can run a series of actions when the banking app is running, or do any of a hundred things to steal money.

> A scam app with root can draw over the screen and tell users to transfer money On android, I believe this can be done rootless via accessibility permissions that can display on top of apps

Yes, but you very much have to grant that permission in Settings. An app can't get it non-interactively.
Post reply on HN