Nothing to do with security, everything to do with control.
The Vietnam government has banned rooted phones from using any banking app
161–170 of 643 posts
Re: The Vietnam government has banned rooted phones from using any banking app
#162> bans rooted phones
> malicious actors just compromise the firmware instead
surprised pikachu face
Re: The Vietnam government has banned rooted phones from using any banking app
#163Serious question, what is gained from this move? Why would a government care? Are rooted phones really that much of a problem? Surely most people running a rooted phone are tech enthusiasts. Cybercriminals will just use regular phones bought under false names and dispose of them afterwards.
They gain credibility with overseas banks. Otherwise, the banks can just say "why do we need to support Vietnam? Too much fraud" and block access from Vietnam and VPNs.
Re: The Vietnam government has banned rooted phones from using any banking app
#164Earlier quoted context omitted.
This seems like a massive jump to conclusions.
It's already reality in my country, where you cannot access online banking for any banks except via their mobile applications, which (of course) refuse to work on anything rooted or running non-stock firmware.
So, I guess it’s a country-dependent jump to conclusions?
I have had a lot of banks and credit cards, mobile payment apps like Venmo/PayPal in the US and they almost all work on mobile web and desktops.
But I recognize that wealthy western countries didn’t really skip the personal computer like many mobile-first regions have done.
Re: The Vietnam government has banned rooted phones from using any banking app
#165So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…
As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…
the iPhone still does bluetooth transmissions/pings even in airplane mode (the find my device thing) and no way to disable
the only way to disable any transmissions is to turn off the device
Re: The Vietnam government has banned rooted phones from using any banking app
#166So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…
I guess you can still do banking on your PC? I stopped using banking apps on my phones a few years ago - they got more and more annoying, and I don't buy into the "the device is secure and should be used as a trust token". So I'm now back to banking only on my computer, with a hardware token for TAN generation.
Hardware tokens are not allowed in Europe to authorize certain operations such as bank transfers: you need a device that can show the operation you are about to authorize ("enter 123456 to confirm your payment of 99.99 € to Pornhub"). And that essentially means using a phone.
Re: The Vietnam government has banned rooted phones from using any banking app
#167Earlier quoted context omitted.
I guess you can still do banking on your PC? I stopped using banking apps on my phones a few years ago - they got more and more annoying, and I don't buy into the "the device is secure and should be used as a trust token". So I'm now back to banking only on my computer, with a hardware token for TAN generation.
That probably means giving up the ability to mobile deposit checks - every bank I've ever had only allows that through their app.
What's a mobile deposit and why do you need an app to check it?
Re: The Vietnam government has banned rooted phones from using any banking app
#168So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…
As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…
Funny - in some ways I have the opposite. In my version:
The iPhone SE would be the one I use for calls, SMS, etc. It has the SIM card.
The Pixel 9a would be used for everything I don't need a data plan/SIM card (browsing etc).
My needs are a bit different from yours. I like to separate telephony and communication (i.e. WhatsApp, SMS) from everything else. This way, if I want quiet, I just turn that phone to airplane mode. I really don't want to get random pings while I'm doing "real" stuff on my phone.
Re: The Vietnam government has banned rooted phones from using any banking app
#169Earlier quoted context omitted.
Well, I've built a bunch of mobile banking apps and we did detect if the phone was rooted, was in dev mode, etc. and it is not because we were "stupid, consumer-hostile, and anti-competitive". If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. There is no way to store customer's secrets in a PC browser securely,…
Why don't banks just make desktop computer applications?
Practically impossible to store secrets in a desktop app too.
Besides, customers would not willing to install a desktop app. And those who would, will require support.
Re: The Vietnam government has banned rooted phones from using any banking app
#170So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…
“Irrefutable part” is easily refutable. Malware ran by governments and agencies is still malware.