Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

431–440 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#431

Post by EvanAnderson »

shimman wrote: post #352
fuzzzerd wrote: post #257

Earlier quoted context omitted.

I hate that future so much, but I don't know what to do to avoid it. My sole choice to bank on pc and use it as a pc will not be considered by the product people making the choice to go smart phone app only. I'm essentially along for the ride because the masses will gobble it up.

You do realize you have the power to organize with other like minded individuals and exert political power right? You don't have to just sit around and "accept this fate." We still live in a democracy, you're allowed to have a say if you want to.

The concern about individual ownership of general purpose computing is of concern to a fraction of a fraction of a fraction of a percentage of people. In the USA, at least, even more basic issues that should matter to a large portion of the population don't because they're distracted by "culture wars" and "wedge issues".

Money is speech, and speech builds political power. Industry lobbies have vastly more money than the minuscule number of people to whom this matters.

On top of that, the market doesn't want general purpose computers. The market wants TikTok terminals and selfie cams. The market wants "content consumption", "AI slop", and "influencers".

If there's no market for what I want it doesn't matter if it's legislated out of existence or not. Nobody will build it if nobody will buy it.

Then there's the apologists for big tech who cry "But they're not computers, they're phones!" when the fact is brought up that we're all carrying general purpose supercomputers bristling with sensors and radios in our pockets but we're not allowed to own them or use them for what we want. (Cue sob stories about clearing malware from oldsters' computers in 3... 2... 1...)

Technologists (who I'd argue should want general purpose computing in the hands of the masses) can't make any money re-architecting the OS and application metaphors and paradigms that give rise to the malware-laden cesspools of end users PCs so they just direct their efforts to working at big tech building the walled-garden prisons that we're all going to be forced into.

It's hard not to feel like I have to accept this fate.

Re: The Vietnam government has banned rooted phones from using any banking app

#432

Post by rerdavies »

stavros wrote: post #425
amelius wrote: post #418

Earlier quoted context omitted.

Well it has always been the case with the mobile telephony IC. Way too dangerous to leave it open to hackers.

What are the dangers that can't be dealt with server-side?

Viruses injecting code into the process of the app that you use to do online banking. obvsly. Or the app you use to do second-factor authentication.

You can protect against that by requiring the app to have a valid signature. You cannot guarantee that the signature is valid unless you can guarantee that the kernel has not been modified. You cannot guarantee that the kernel has not been modified if the phone has been rooted.

For what it's worth, my banking app for my Canadian bank (and the app which does second-factor authentication for web transactions when doing web-based online banking) will not run on a rooted phone. For good reason, I think.

My bank used to use SMS for second-factor authentication, but no longer does so. For good reason. When I do online banking from my desktop, I still have to use the second-factor authentication login on my phone. Or sim-less tablet, interestingly. Whatever the mechanism, is, it is not SMS based.

Re: The Vietnam government has banned rooted phones from using any banking app

#433

Post by StrLght »

fph wrote: post #149
seszett wrote: post #135

Earlier quoted context omitted.

That's what I do too (not iOS + GrapheneOS but the result is the same) as I was tired of fighting to make my bank apps and itsme (digital identity app in Belgium) work on my rooted phone. Everytime I have to use a stock phone I'm appalled at the ads and I have absolutely no trust in any US or Chinese manufacturer. So I use them only for banking and digital id because that's presumably not what they actually care abou…

It is very ironic that the solution is using an old, insecure phone full of unpatched holes for all important banking and id business, because that one is vendor-allowed while your state-of-the-art GrapheneOS is not.

If only banks cared about state-of-the-art security.

In reality, banks couldn’t care less. They only care about checking boxes and don’t consider where these boxes come from; every unchecked box is a risk.

Did the latest sham "security audit" say that root is bad? They'll block it.

Re: The Vietnam government has banned rooted phones from using any banking app

#434

Post by Melonai »

2OEH8eoCRo0 wrote: post #421
sneak wrote: post #333

Earlier quoted context omitted.

It’s not an evil at all. For 99% of people who aren’t “computer people”, when we gave them that, we got the Bonzai Buddy and 47 other malware toolbars installed. Did we forget 2003 already? App sandboxing and system file integrity is one of the most beneficial security features of modern computing, and the vast majority of people have no desire to turn it off. You can buy rootable phones. People overwhelmingly choose…

"I don't like Bonzi Buddy so people should be prevented from installing it."

Okay, it is a full on spyware virus though, not super sure why people would love Bonzi on their system.

This is kind of a shitty compromise, the second you leave a tiny crack open in the security, maybe through root access, maybe some better sideloading, somehow people WILL be tricked into installing malware, and it baffles me...

I've seen it happen multiple times with my older (and younger, though less often) relatives and acquaintances, I'm really not sure how like a solid 5 dialogs that scream at them with sayings like "do not do this", "this is dangerous", "if someone is telling you to do this they're a scammer", and that somehow raises zero alarms, however if you tell them to consider the possibility that they're downloading a virus, or that the nice IT man on the phone is probably not that trustworthy, they will simply not believe you.

That's why I kind of get the paranoia, though most of it is just that and I really believe that software freedom is a whole lot more important.

Re: The Vietnam government has banned rooted phones from using any banking app

#435

Post by wolvoleo »

pas wrote: post #390
wolvoleo wrote: post #341

Earlier quoted context omitted.

> App sandboxing and system file integrity is one of the most beneficial security features of modern computing, You can have sandboxing and system integrity while still giving the user overrides. But hey this is not Google and Apple's business model because it makes you less dependent on them. And it interferes with their sweet 30% rent-seeking app stores. Mobile security works this way not because it's best for us b…

> You can have sandboxing and system integrity while still giving the user overrides. How? What kind of overrides? You mean that Safetynet could still report attestations? I have no idea how it works, but doesn't it require a chain of trust, starting from a known boot image, then every process that can write to arbitrary memory needs to be a known image? (And even that might not be enough if there are ways to dynamic…

No, you can just make a system secure without requiring attestation and stuff like that.

I don't believe in remote attestation anyway. It didn't even say the service is secure. It just proves it's as released by Google. But security doesn't have to rely on a big brother checking things for you. You can have security without it.

Re: The Vietnam government has banned rooted phones from using any banking app

#436

Post by amelius »

stavros wrote: post #425
amelius wrote: post #418

Earlier quoted context omitted.

Well it has always been the case with the mobile telephony IC. Way too dangerous to leave it open to hackers.

What are the dangers that can't be dealt with server-side?

The main danger is a virus that infects everybody's phones and then takes control of the telephony modem, e.g. like a DDOS attack.

That's why you can't have root access to the modem even though you technically own it.

Re: The Vietnam government has banned rooted phones from using any banking app

#437

Post by StrLght »

iso1631 wrote: post #249
Helmut10001 wrote: post #106

Earlier quoted context omitted.

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

> This is expensive, but I found it to be the only viable solution to this problem. Is it really? £150 on backmarket for a phone which will last 10 years doesn't feel expensive. Makes sense to me to run any banking on a secure device anyway.

A £150 back market phone is not a secure device. It probably stopped receiving security patches a month after its release.

Re: The Vietnam government has banned rooted phones from using any banking app

#438

Post by BobaFloutist »

ambicapter wrote: post #406
LoganDark wrote: post #340

Earlier quoted context omitted.

The problem is mostly that normal people can't be trusted with system-level access but some people can. And it's literally, provably not possible to tell them apart. For the masses, lack of system-level access is a benefit because they won't be able to ruin their device. For hackers and hobbyists, lack of system-level access is a hindrance because they won't be able to control their device.

If the only damage is personal (they lose their own money), why can't we make them responsible for their choices?

Because enough people losing their own money in the same way becomes a social ill.

Much in the same way we try to limit physical addiction, which hypothetically only affects the person taking the substance, and gambling (though we're moving backwards on sports betting).

Some hypothetical social ills: 1 If it's a good source of money, it becomes more ubiquitous. This leads to entire illegal markets, which will typically lead to additional crimes, up to and including human trafficking, slavery, organ harvesting, and murder https://en.wikipedia.org/wiki/Scam_center.

2. The victims of scams will often feed shared or even stolen assets into the scam, desperately relying on an eventual return that will never come. This mirrors one of the better known social ills of gambling and addiction.

3. Even for people that never fall victim, defending against scams is tiring, irritating, and damages social fabric. An easy example is how spam cuts down on the utility of phone calls. In general, to be safe you have to be almost irrationally suspicious of anyone being surprisingly friendly, which makes non in-person connections -one of the greatest benefits of the internet - much harder and more dangerous to forge.

What do you think, is that enough reasons?

Re: The Vietnam government has banned rooted phones from using any banking app

#439

Post by luqtas »

zozbot234 wrote: post #246
gruez wrote: post #190

Earlier quoted context omitted.

>An unmodified iPhone SE (2022 model) with OS support until 2032 What makes you think it'll be supported for a decade? Looking at the past models, the support period is around 5-7 years. If you count security updates that might get you to 10 years, but at the 7-9 year mark apps will eventually refuse to update because you're not on the latest ios. https://en.wikipedia.org/wiki/IPhone#Models

By the time that iPhone SE 3 finally goes unsupported (even the iPhone SE 2 from 2020 has yet to lose support) you'll just buy a cheap refurbished iPhone 16e. Old-gen iPhones are widely available and quite cheap.

i think most here if not all, people complaining by predatory practices of not supporting or liberating your device to whatever you want, are not worried or effected by monetary reasons

for my smartphone usage, i could still use my iphone se (1° gen) perfectly fine and that would include writing some pieces with garageband; which got deprecated and non-download-able because newer versions weren't aimed to my iOS version. heck the vast majority of smartphones aren't compilling software with local hardware (nor i know why someone would do)... guess we could stop with processing power advancement of 2015 just fine to run Whataspp and Instagram. producing hardware is costly, not everyone has a decent job nor minerals are infinite and have no ecological impact

Re: The Vietnam government has banned rooted phones from using any banking app

#440

Post by StrLght »

pessimizer wrote: post #382
Helmut10001 wrote: post #106

Earlier quoted context omitted.

As I mentioned in another post: By 2026, you'll need two phones. My current setup: 1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it. 2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access. This is expensive, but I found it to be the only viable solution to…

> As I mentioned in another post: By 2026, you'll need two phones. My current setup: Cheers, maybe by 2027 unattested devices won't be allowed on the internet. It's not a solution. The problem didn't exist a few years ago, the idea that it will not continue to its inevitable conclusion within a few years without real solutions is laughable. Wait until Graphene is classified as a hacking tool and Estonia convinces the…

I understand that you’re using it as an example, but I still find it very misleading. Estonia is pro-privacy and has consistently voted against Chat Control.

On the other hand, France has been undermining privacy for a few years now. They supported Chat Control, have attacked GrapheneOS, etc.

Post reply on HN