Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

201–210 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#201

Post by jama211 »

Helmut10001 wrote: post #106
Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

With all due respect - I totally understand you may need a rooted phone, I’m just curious what you use it for? I’ve never had a modified or rooted phone so I don’t know of any of the reasons you might need one.

Re: The Vietnam government has banned rooted phones from using any banking app

#202

Post by hackyhacky »

mike_hearn wrote: post #191
hackyhacky wrote: post #89

Earlier quoted context omitted.

> A scam app with root Sure. But the people who are actually rooting their phones are advanced users and aren't going to install a malicious custom OS. Are naive users getting tricked into rooting their own phones? I'm dubious what the security benefit is of this decision.

These types of discussions on HN get confused because people aren't always clear what they mean by the word "rooting". There are two ways to root a phone: 1. Unlock the bootloader, install a well designed and highly secure aftermarket OS, relock the bootloader. The device is still just as secure against malware as it was before. Remote attestation shows the vendor that you're running Graphene or Lineage or whatever.…

Thanks for clarifying. I was unaware that (2) was a widespread issue.

Re: The Vietnam government has banned rooted phones from using any banking app

#203

Post by SkiFire13 »

hirako2000 wrote: post #64
varenc wrote: post #25

Earlier quoted context omitted.

I assume the bank apps have functionality that their websites lack. Like being able to tap to pay for things, etc. Where a rooted phone might make fraud easier. If not, then this really makes no sense.

Malware is more easily spread onto rooted phone, that's for sure. From they you can keylog. Highjack input listeners, basically do anything you want.

That's what a malware can do on a rooted phone, _once it gets root access_, but that doesn't mean a rooted phone is easier for malware to attack.

There's not even that many people using rooted phones, and many are tech savvy people that are generally a bit more careful, so even if a rooted phone gets infected by some malware chances are the malware won't even be written in such a way to try to obtain root permissions through the standard procedure and exploit it.

Re: The Vietnam government has banned rooted phones from using any banking app

#204

Post by jacobthesnakob »

Helmut10001 wrote: post #106
Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

Why though? What are you doing on your Pixel that wouldn’t be more secure doing on an iPhone with a double hop or dual-encapsulated VPN?

Re: The Vietnam government has banned rooted phones from using any banking app

#205

Post by izacus »

Aspos wrote: post #99
elric wrote: post #43

Earlier quoted context omitted.

There's no laws banning this in any European countries that I'm aware of, except maybe Hungary? It's just banks being stupid, consumer-hostile, and anti-competitive.

Well, I've built a bunch of mobile banking apps and we did detect if the phone was rooted, was in dev mode, etc. and it is not because we were "stupid, consumer-hostile, and anti-competitive". If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. There is no way to store customer's secrets in a PC browser securely,…

> If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk.

Now that's just not true now, is it? Sure the lawyers told you that (the ones that get paid to tell you that), but nowhere in EU was a bank actually fined for not root checking a device.

They were plenty fined by being utterly incompetent with security practices and doing them poorly - like trying to inject wierd .SOs to do the root detection you're defending.

Re: The Vietnam government has banned rooted phones from using any banking app

#206

Post by fenaer »

ExpertAdvisor01 wrote: post #125
fenaer wrote: post #20

Unfortunately the answer here is to not abide by the law. If there is a reasonable way to bypass this (as the cat-and-mouse game always seems to continue), and there is reasonable expectation to not be caught, then I see no moral quandary with ignoring such a consumer-hostile rule.

There won't be a reasonable way to bypass it as it requires a Google authenticated manufacturer to leak the keys or an TEE exploit. All public key boxes are banned and Google regularly bans new ones . That endpoint contains the list of revoked keyboxes : https://android.googleapis.com/attestation/status

I'm not a security researcher, but I do believe in the ingenuity of others. If all else fails, this kind of law in my own country would lead me to running apps within a virtualised environment (if possible), or a dedicated cheap device in a drawer with my actual device still being mine.

Re: The Vietnam government has banned rooted phones from using any banking app

#207

Post by MobiusHorizons »

NoMoreNicksLeft wrote: post #174
aspbee555 wrote: post #165

Earlier quoted context omitted.

the iPhone still does bluetooth transmissions/pings even in airplane mode (the find my device thing) and no way to disable the only way to disable any transmissions is to turn off the device

Bluetooth's the same RF chip as wifi in new phones isn't it? Can't just exacto knife a trace on the board without murdering everything I take it?

I could be wrong, but on a lot of mobile SOCs all of the modems are in the same chip as the CPU. I think you would have better luck removing the connection to the antenna

Re: The Vietnam government has banned rooted phones from using any banking app

#208

Post by EvanAnderson »

finaard wrote: post #127
Fiveplus wrote: post #82

So, if you cannot cryptographically prove to a remote server that your device is running essentially unmodified, vendor-signed software, you are locked out of the economy? The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own…

I guess you can still do banking on your PC? I stopped using banking apps on my phones a few years ago - they got more and more annoying, and I don't buy into the "the device is secure and should be used as a trust token". So I'm now back to banking only on my computer, with a hardware token for TAN generation.

Hyperbolic take - There won't be PCs, as we know them, for too much longer (both by way of being made into walled garden phone-like "appliances" by software, and by the hardware becoming unavailable).

Re: The Vietnam government has banned rooted phones from using any banking app

#209

Post by SkiFire13 »

edent wrote: post #12
Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

Yes, but a web browser doesn't run HTML + JS as root.

A rooted android device doesn't run apps as root either, not does it generally allow them to get root access without the user accepting a system prompt.

Re: The Vietnam government has banned rooted phones from using any banking app

#210

Post by duser1 »

mschuster91 wrote: post #189
add-sub-mul-div wrote: post #117

Earlier quoted context omitted.

> you are locked out of the economy? Not that it excuses the withdrawal of user agency. But I've never used a banking app on my phone before. Anything important I still like to do on a desktop. Though how much longer that's safe, who knows. Apple's model of requiring their permission to run code on your own device will probably spread to everything given enough time.

> But I've never used a banking app on my phone before. Here in Europe, good luck using any form of online payment without one due to 2FA requirements.

I don't have a problem with online payments, and I'm not using a banking app.
Post reply on HN