321–330 of 643 posts
Earlier quoted context omitted.
Not if you want to use tap-to-pay systems.
I wonder if this makes room in the market for some simpler device for payments. Something like a wearable that you can tap-to-pay and has the signed software attenuation but nothing else so you can't be tracked using GPS.
Like a credit card? They've been around for some time.
The biggest "evil" that has been committed (and is still being committed) against computing has been normalizing this idea of not having root access to a device you supposedly own. That having root access to your computer, and therefore being the ultimate authority over what gets run on it, is bad or risky or dangerous. That "sideloading" is weird and needs a separate name, and is not the normal case of simply loadin…
Earlier quoted context omitted.
Well, I've built a bunch of mobile banking apps and we did detect if the phone was rooted, was in dev mode, etc. and it is not because we were "stupid, consumer-hostile, and anti-competitive". If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk. There is no way to store customer's secrets in a PC browser securely,…
Why don't banks just make desktop computer applications?
Earlier quoted context omitted.
Hardware tokens are not allowed in Europe to authorize certain operations such as bank transfers: you need a device that can show the operation you are about to authorize ("enter 123456 to confirm your payment of 99.99 € to Pornhub"). And that essentially means using a phone.
Is this true? The old, standard RSA number generator token key ring device is not permitted in Europe for authorizing bank actions ?
The requirement is called "dynamic linking" (the 2FA code must be tied to the specific transaction) and the relevant regulation is PSD2.
India doesn’t have a single “govt ban rooted phones from banking apps” rule, but RBI’s digital payment security controls explicitly allow banks to block mobile apps on rooted/jailbroken devices, and many do. Combine that with device+SIM binding requirements and platform attestation (e.g., Play Integrity), and the practical result is often “no banking/UPI on rooted phones.”
Earlier quoted context omitted.
As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…
I'm also a big GrapheneOS user, but I'm lucky enough that my banking and authentication apps run fine on GrapheneOS, so no need for a second phone. If they stopped, I think I would seriously consider swapping banks and whatever else instead of using a different OS.
Earlier quoted context omitted.
Not if you want to use tap-to-pay systems.
Tap a bankcard? You can even tape it to the back of your phone
Earlier quoted context omitted.
Hyperbolic take - There won't be PCs, as we know them, for too much longer (both by way of being made into walled garden phone-like "appliances" by software, and by the hardware becoming unavailable).
I hate that future so much, but I don't know what to do to avoid it. My sole choice to bank on pc and use it as a pc will not be considered by the product people making the choice to go smart phone app only. I'm essentially along for the ride because the masses will gobble it up.
I grew up in a world where personal computers weren't strange things (the 1980s). I remember reading Levy's "Hackers" in my teens and not comprehending how people could think personal computers were such a big deal. The talk about "technical priesthoods" and mainframes, the inaccessibility of computers to "normal people", etc, didn't mean anything to me.
Now that I'm living through the twilight of the personal computer I understand.
Google is to blame, they're abusing device security by preloading their unremovable spyware with elevated privileges.. people then want to remove it but then find themselves unable to use banking apps because of this. I'm not against having a separate secure phone to use with banking apps, but that phone must be designed for security, not for Google's ad driven business model..
Your words can be reasonably interpreted as "that phone must be an iPhone"; did you actually mean this?
I wish we didn't have to choose between Google and Apple, especially here in Europe where we can be sactioned by the US for doing our job..
I get the general skepticism and how this gives anti freedom vibes, but wouldn't this also prevent some actual rootkit like sideloaded apps stealing credentials? Not deep into rooting scene but seems plausible to me that this has some merit if you squint at it from the right angle
Here's the fundamental problem: Trusted agents are useful. And I'm using legal meanings, not technical meanings here - so a "trusted agent" is someone or something that is legally acting on your behalf, to perform actions as though you were performing them. The whole fucking promise of "general purpose computing" is that citizens should be able to delegate repetitive and tedious tasks to a computer. And they should h…