Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FSF announces Librephone project

fsf.org

Post reply on HN
Print view View original

41–50 of 669 posts

Re: FSF announces Librephone project

#41

Post by _blk »

SoftTalker wrote: post #27
bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

Use the website. I’ve never seen a bank where a mobile app is the only option for remote access. If my bank did that, I’d switch banks.

UBS bank mandates their "Secure Access" app as second factor even when logging in from a desktop. They used to allow the smart card reader for existing customers that had it as a work around for a few years but they disabled that.

Also many websites are making it remarkably hard to not use the app if they even remotely sense you're not on an actual PC. FB and LinkedIn aren't banks but prime examples.

Re: FSF announces Librephone project

#42

Post by koolala »

brewdad wrote: post #40
koolala wrote: post #24

Earlier quoted context omitted.

What kind of transactions require this? Normal bank transactions don't, right?

My brokerages require it every time I login from a computer. My bank will require it if it can't find a cookie from a previous login session. Occasionally, my bank will require it seemingly randomly since I usually log in at least once a week from my laptop yet every couple of months or so I have to reconfirm on the app or another secondary method.

What are the other secondary methods?

Re: FSF announces Librephone project

#43

Post by _blk »

_blk wrote: post #41
SoftTalker wrote: post #27

Earlier quoted context omitted.

Use the website. I’ve never seen a bank where a mobile app is the only option for remote access. If my bank did that, I’d switch banks.

UBS bank mandates their "Secure Access" app as second factor even when logging in from a desktop. They used to allow the smart card reader for existing customers that had it as a work around for a few years but they disabled that. Also many websites are making it remarkably hard to not use the app if they even remotely sense you're not on an actual PC. FB and LinkedIn aren't banks but prime examples.

Oh, and of course the stock app will refuse to run on rooted (or sometimes even just not widely used) phones.

Re: FSF announces Librephone project

#44

Post by [deleted] »

kennywinker wrote: post #33
SchemaLoad wrote: post #12

Earlier quoted context omitted.

These days browsers are becoming increasingly distrusted. My bank logs my browser out after 30 minutes inactivity and then to log back in I have to confirm the login on my phone.

That… seems reasonable? My bank does that with their website and their mobile app. I was able to setup 2fa using a totp app, so i don’t rely on sms for that part

[deleted]

Re: FSF announces Librephone project

#45

Post by linguae »

bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

This was a problem during the early 2000s when Windows and Internet Explorer were utterly dominant. Some banks, government services, and other essential websites used ActiveX controls, preventing access by non-Windows users. I remember during my senior year of high school being unable to fill out a college financial aid application circa late 2004 or early 2005 on my PC running FreeBSD and Firefox; I needed to use Windows and Internet Explorer.

I remember the stagnation of Internet Explorer combined with increased awareness of security exploits in Windows and Internet Explorer led to the rise of Mozilla Firefox and (to a lesser extent) increased marketshare for the Mac. This, combined with the arrival of smartphones around 2007, put pressure on organizations to make their Web sites accessible to a wider range of browsers instead of just IE.

Perhaps if we had a critical mass of people using phones with FOSS software, this would be enough for banks and other organizations to consider people who don’t use Apple/Google products.

The challenge, though, is getting that critical mass. Firefox benefitted from Microsoft’s fumbles in the 2000s. It’s going to be hard for a FOSS project to compete head-on against Apple and Google.

Re: FSF announces Librephone project

#46

Post by SchemaLoad »

kennywinker wrote: post #33
SchemaLoad wrote: post #12

Earlier quoted context omitted.

These days browsers are becoming increasingly distrusted. My bank logs my browser out after 30 minutes inactivity and then to log back in I have to confirm the login on my phone.

That… seems reasonable? My bank does that with their website and their mobile app. I was able to setup 2fa using a totp app, so i don’t rely on sms for that part

It is given the environment. But it does highlight the poor security of desktop browsers where they are only trusted to do anything when a phone app approves it. While the phone app is considered secure enough to just stay logged in perpetually without any external confirmation.

To hack the banks app you have to find an exploit in iOS or Android which would allow you to read the other apps private storage, which is borderline impossible now. To hack the banks website you just have to buy some random browser extension and add malware to it, or break into someones NPM account and distribute it there, or any number of ways to run code on someone else's computer. Something very achievable by an individual.

Re: FSF announces Librephone project

#47

Post by beeflet »

ACCount37 wrote: post #18
bsimpson wrote: post #11

Interesting that they chose Android as a base and not one of the desktop-Linux-for-mobile ports like postmarketOS.

App compatibility is a thing, you know. I like postmarketOS, but it always felt to me more like a pet project than a real OS, for that reason.

waydroid

Re: FSF announces Librephone project

#48

Post by jojobas »

koolala wrote: post #24
jojobas wrote: post #8

Earlier quoted context omitted.

Some banks require app confirmation for PC-initiated transactions, using play integrity requiring apps. Cause security, you know.

What kind of transactions require this? Normal bank transactions don't, right?

Transfer of more than a set amount between even your own accounts in different banks.

Re: FSF announces Librephone project

#49

Post by kovac »

bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

I think this is the right place to start.

A free OS will empower developers to implement technical workarounds that could trick these apps into working there. If the OS is tightly controlled, we have no recourse.

Even in the worst case scenario, we could use a cheap big-tech-approved phone for these applications (a glorified digital token) and use the free phone for everything else. When there's enough adoption and trust in the new phone, non-technical avenues are available to influence these organizations to accept the alternative.

Re: FSF announces Librephone project

#50

Post by ipaddr »

bigstrat2003 wrote: post #4

Ultimately, I don't think the most important challenge is in binary firmware blobs, but the software which people depend upon to run their lives. What does it matter if you can run a completely free software stack on your phone, if your bank software (or your required government ID, as is looking depressingly likely) requires you to run a Big Tech approved phone OS? Perhaps the FSF can't do much about that, but that…

Get a big tech second phone. Cheapest available. Just perform the needed tasks and use your Libre phone for everything else.

Does anyone remember having a copy of internet explorer that the bank required (or chrome these days) but using firefox for everything else? Apply that concept to a phone.

Post reply on HN