Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

221–230 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#221

Post by snackbroken »

OutOfHere wrote: post #111

Why can't rooted phones pretend to be non-rooted phones for the purpose of certain apps? What's the point of rooting if you can't even selectively pretend?

Because root is not the ultimate authority of what goes on in the phone; the hardware is, and the hardware contains a TPM (Treacherous Platform Module). The TPM has secret cryptographic keys it never shares with anyone, neither root nor an unrooted OS. When the phone starts, the TPM checks if the OS has been modified from what the manufacturer supplies or not.

The bank's app can then ask the OS to sign documents using the TPM's secret keys, and the OS forwards such requests to the TPM. The TPM refuses such requests from modified OS but obliges requests from an unmodified OS. The bank's servers refuse to accept documents not signed by the TPM.

Root can't pretend to be a TPM and make up some secret keys to sign documents with because the TPM's signature is itself signed by Google, so the bank can tell the difference between root's signature and a treacherous signature.

Re: The Vietnam government has banned rooted phones from using any banking app

#222

Post by wrennes »

ymyms wrote: post #200
derefr wrote: post #187

Earlier quoted context omitted.

Not if you want to use tap-to-pay systems.

I wonder if this makes room in the market for some simpler device for payments. Something like a wearable that you can tap-to-pay and has the signed software attenuation but nothing else so you can't be tracked using GPS.

This will be the answer as we move away from screens as phones. Smart watches have slowly edged in, but I foresee some 'no screen' being the answer to payments, access control, etc

Re: The Vietnam government has banned rooted phones from using any banking app

#223

Post by WhyNotHugo »

tetris11 wrote: post #159
seszett wrote: post #135

Earlier quoted context omitted.

That's what I do too (not iOS + GrapheneOS but the result is the same) as I was tired of fighting to make my bank apps and itsme (digital identity app in Belgium) work on my rooted phone. Everytime I have to use a stock phone I'm appalled at the ads and I have absolutely no trust in any US or Chinese manufacturer. So I use them only for banking and digital id because that's presumably not what they actually care abou…

My job's SSO moved to provider that either required an unrooted phone or a reliable Voice auth. For 2 years the voice authentication worked fine (they call me, I type in a number) on my regular rooted phone. Then one random morning I just stopped getting the phone calls. "Network said no". Complete lock out, nothing I could do except go out and panic-buy an unrooted phone not running Lineage and using a modern Androi…

This does sounds like the situation where the employer should provide you with the phone.

Re: The Vietnam government has banned rooted phones from using any banking app

#224

Post by bakugo »

Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

In some countries, it's already impossible to make online payments without the bank's phone app. Only a matter of time until all banking is restricted to phones.

Re: The Vietnam government has banned rooted phones from using any banking app

#225

Post by latentsea »

Helmut10001 wrote: post #106
Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

This. I've had to run two phones for some time now, and have just accepted this is the new normal.

Re: The Vietnam government has banned rooted phones from using any banking app

#226

Post by hexagonwin »

doublerabbit wrote: post #192
aspbee555 wrote: post #165

Earlier quoted context omitted.

the iPhone still does bluetooth transmissions/pings even in airplane mode (the find my device thing) and no way to disable the only way to disable any transmissions is to turn off the device

I've turned off find my device on my device. Although, I am still using 17.7.2 that won't stop nagging me to upgrade to iOS 26.2. I don't want to because I know I'll hate it.

you can kill the ota nagging very easily without any side effects, try searching for tvos profile

Re: The Vietnam government has banned rooted phones from using any banking app

#227

Post by kube-system »

te7447 wrote: post #215
kube-system wrote: post #126

Earlier quoted context omitted.

> We are moving to a model where the user is considered the adversary on their own hardware. That has been the model since day one, since you are using spectrum that, because the end users are not licensed, requires it. Radios in 100% of commercially available phones are locked to prevent user tampering. You don't get root on your debit card either, despite it running a computer.

> That has been the model since day one, since you are using spectrum that, because the end users are not licensed, requires it. Radios in 100% of commercially available phones are locked to prevent user tampering. Why, then, can users be root on PCs that have wifi cards, SDRs or cellular radios?

Wifi? Because it is part 15. That spectrum is less strict.

SDRs? Because they are not certified transmitters. They are test RF gear, or a component of a transmitter, not an end-user product.

Cellular radios in a PC? You don't get root on those. Same situation as they are in a cell phone: They are licensed-band transmitters, and they are required to be tamper proof to protect the licensee.

Re: The Vietnam government has banned rooted phones from using any banking app

#228

Post by cestith »

add-sub-mul-div wrote: post #117
Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

> you are locked out of the economy? Not that it excuses the withdrawal of user agency. But I've never used a banking app on my phone before. Anything important I still like to do on a desktop. Though how much longer that's safe, who knows. Apple's model of requiring their permission to run code on your own device will probably spread to everything given enough time.

Much of the world uses mobile payment apps instead of credit or debit cards. Some banks allow a setting that using a card can require a ping to the banking app for verification of the transaction. I don’t know if it’s legal to turn down cash payments in Vietnam, but some vendors may only accept digital payments.

I guess you could take your laptop out at the restaurant and in the taxi to pay. It seems a little strange. You might better just use a browser on the smartphone instead of the mobile app.

Re: The Vietnam government has banned rooted phones from using any banking app

#229

Post by WhyNotHugo »

fph wrote: post #166
finaard wrote: post #127

Earlier quoted context omitted.

I guess you can still do banking on your PC? I stopped using banking apps on my phones a few years ago - they got more and more annoying, and I don't buy into the "the device is secure and should be used as a trust token". So I'm now back to banking only on my computer, with a hardware token for TAN generation.

Hardware tokens are not allowed in Europe to authorize certain operations such as bank transfers: you need a device that can show the operation you are about to authorize ("enter 123456 to confirm your payment of 99.99 € to Pornhub"). And that essentially means using a phone.

I’ve seen dedicated hardware devices which scan a QR-like code and show this in a little screen of their own. The bank provides them and does not require any app.

I only know of a single bank using this.

Re: The Vietnam government has banned rooted phones from using any banking app

#230

Post by jacobthesnakob »

mike_hearn wrote: post #191
hackyhacky wrote: post #89

Earlier quoted context omitted.

> A scam app with root Sure. But the people who are actually rooting their phones are advanced users and aren't going to install a malicious custom OS. Are naive users getting tricked into rooting their own phones? I'm dubious what the security benefit is of this decision.

These types of discussions on HN get confused because people aren't always clear what they mean by the word "rooting". There are two ways to root a phone: 1. Unlock the bootloader, install a well designed and highly secure aftermarket OS, relock the bootloader. The device is still just as secure against malware as it was before. Remote attestation shows the vendor that you're running Graphene or Lineage or whatever.…

>These types of discussions on HN get confused because people aren't always clear what they mean by the word "rooting".

Well it’s more the Dunning Krugerites who see the word “rooting” written by someone in a cyber context, lack that context entirely, and proceed to enter the discussion anyway based on their experience rooting their Android phone 3 years ago after clicking through a few UI buttons.

Post reply on HN