Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

441–450 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#441

Post by elric »

Magnusmaster wrote: post #367
elric wrote: post #332

Earlier quoted context omitted.

And surprisingly I can pay securely using my PC, fully rooted, on FOSS software. Hardware tokens have been a thing for decades. There are more second (or third) factor authentication and signing solutions than I can enumerate. Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.

Most banks don't know hardware tokens are a thing. They want everyone to use their app.

Is this yet more evidence of how utterly broken US banks are? Assuming you are referring to US banks.

For the past 20 or so years, every bank I've been with in Belgium has provided me with one of three types of hardware token:

1. An OTP token that's just a screen that displays a new 6 digit token every couple of seconds (haven't seen one of these in a few years now). This was used to supplement username/password on login and to verify every bank transfer.

2. A token with a screen and a display, which generates OTPs based on input. E.g. for a payment the bank would tell me to enter the amount + the last N digits of the bank account, the token then generates an OTP, which I can use to confirm the payment. That's what 2 of my 3 banks currently use. They have separate modes for logging in, for signing bank transfers, for signing 3D Secure online payments, etc.

3. A card reader where where I just slot in my card. I can then log in or sign payments using the card's chip & pin. This is what my third bank uses. There are a couple of variants on this, such as models which connect with USB and models which can read QR codes from your screen so you don't have to tap in anything except for your PIN.

Re: The Vietnam government has banned rooted phones from using any banking app

#442

Post by thewebguyd »

malux85 wrote: post #381
thisislife2 wrote: post #372

Earlier quoted context omitted.

Or ... just don't install the apps and use the browser to do your banking.

Assuming the browser has feature parity. I was visiting my parents over Xmas and my dad couldn’t make a payment because the number of saved payees was capped to 100. There was literally no option to delete a payee in the website, the only way we found was to install the app, authenticate, and do it in there. It’s happening already.

I hate that this is happening. I absolutely detest doing any kind of task other than pure content consumption and basic messaging from a smart phone.

Anything remotely more advanced than that, please let me use my computer and an app or website with, you know, an interface designed for more advanced operations.

Trying to do anything on a smartphone/touchscreen only device is nothing but an effort in pure frustration for me.

Re: The Vietnam government has banned rooted phones from using any banking app

#443

Post by yibg »

sneak wrote: post #373
drnick1 wrote: post #362

Earlier quoted context omitted.

> normal people can't be trusted with system-level access but some people can. Why can "normal people" be trusted with a car then? Or firearms? Or kitchen knives?

Well, normal people generally can’t be trusted with cars: in one country of only 3.5% of the humans we kill two jumbo jets worth of people with them every day. Tylenol is another example. Building materials is a third (building and fire codes are a relatively recent invention). Hell, even penicillin is by prescription only. Letting the circumstance happen where median people can easily cause externalities through ign…

That seems like an untenable stance. Most people don't pick healthy foods to eat or exercise as much as they should. Should we dictate what they can and cannot eat etc?

Re: The Vietnam government has banned rooted phones from using any banking app

#444

Post by thewebguyd »

ploxiln wrote: post #365
ryandrake wrote: post #309

The biggest "evil" that has been committed (and is still being committed) against computing has been normalizing this idea of not having root access to a device you supposedly own. That having root access to your computer, and therefore being the ultimate authority over what gets run on it, is bad or risky or dangerous. That "sideloading" is weird and needs a separate name, and is not the normal case of simply loadin…

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.

Nah, if a bank or some other civic entity wants to have a "secure agent" for transactions/communication with me, then they should be the ones providing that.

Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work.

I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.

Re: The Vietnam government has banned rooted phones from using any banking app

#445

Post by stavros »

rerdavies wrote: post #432
stavros wrote: post #425

Earlier quoted context omitted.

What are the dangers that can't be dealt with server-side?

Viruses injecting code into the process of the app that you use to do online banking. obvsly. Or the app you use to do second-factor authentication. You can protect against that by requiring the app to have a valid signature. You cannot guarantee that the signature is valid unless you can guarantee that the kernel has not been modified. You cannot guarantee that the kernel has not been modified if the phone has been…

That's not the mobile telephony IC. That's just the phone's CPU.

Re: The Vietnam government has banned rooted phones from using any banking app

#446

Post by tzs »

sneak wrote: post #373
drnick1 wrote: post #362

Earlier quoted context omitted.

> normal people can't be trusted with system-level access but some people can. Why can "normal people" be trusted with a car then? Or firearms? Or kitchen knives?

Well, normal people generally can’t be trusted with cars: in one country of only 3.5% of the humans we kill two jumbo jets worth of people with them every day. Tylenol is another example. Building materials is a third (building and fire codes are a relatively recent invention). Hell, even penicillin is by prescription only. Letting the circumstance happen where median people can easily cause externalities through ign…

> Well, normal people generally can’t be trusted with cars: in one country of only 3.5% of the humans we kill two jumbo jets worth of people with them every day.

If you mean Indonesia (the county closest to 3.5% of the human population) or the US (the nearest above 3.5% at 4.1%+) then you are high by an order of magnitude. Two jumbo jets are around 1000 people. US car deaths are around 100 a day and Indonesia is a little lower.

If you mean Pakistan (the next country after Indonesia at 2.9%) you are high by close to two orders of magnitude. They have around 15 deaths a day.

Re: The Vietnam government has banned rooted phones from using any banking app

#447

Post by Roark66 »

ryandrake wrote: post #309

The biggest "evil" that has been committed (and is still being committed) against computing has been normalizing this idea of not having root access to a device you supposedly own. That having root access to your computer, and therefore being the ultimate authority over what gets run on it, is bad or risky or dangerous. That "sideloading" is weird and needs a separate name, and is not the normal case of simply loadin…

Exactly. Also the smaller stupidity - inability to add your own root certificates to the system store.

In fact this is what led me to unlocking the bootloader, swapping the OS and rooting my phone. The infuriating situation where if you setup so called "corporate owner" (or mdm) during the first login you can add your own certificates, but if you don't... Basically the "corporate owner" of your phone is Google.

Yes, literally, you do not own it.

Also it is worth noting certain countries where "rooting/bootloader unlocking is illegal" - namely China and the horrible stupidity of people claiming EU Gdpr prevents manufacturers from offering simple bootloader unlocks for their phones.

We absolutely need to vote with our walkers. I bought a Samsung before and a Xiaomi recently only because both allow relatively simple unlock (ok the Xiaomi requires you to wait to press "request unlock" exactly at midnight Beijing time", and it only works for non-Chinese phones, but still unlocks fine.

Re: The Vietnam government has banned rooted phones from using any banking app

#448

Post by thewebguyd »

pie_flavor wrote: post #383
hephaes7us wrote: post #342

Earlier quoted context omitted.

The evil is enshrining other people's choices into law, unnecessarily. There was never going to be anything preventing non-technical folks from buying iPhones. They can and should have what they like. Why should there be a law that forces that same compromise onto anyone who can only afford a single device and needs to use it to access their bank?

Because when you don't do this, people get scammed out of money. If there is a series of buttons you can press to circumvent the anti-scam measures, then the scammers simply walk you through pressing those buttons. If you cover them in giant warning labels the scammers simply add explanations into their patter. The buttons must physically not exist, for gullible people to not get scammed out of money. The next respon…

> If there is a series of buttons you can press to circumvent the anti-scam measures, then the scammers simply walk you through pressing those buttons. If you cover them in giant warning labels the scammers simply add explanations into their patter. The buttons must physically not exist, for gullible people to not get scammed out of money.

We shouldn't be protecting someone that gullible at the expense of everyone else who is smart enough to actually read whats on the screen and not fall for such simple scams.

Not that long ago most of this forum was very much against giving up freedoms in favor of catering to the lowest common denominator. What happened?

People need to take responsibility for their own actions and educate themselves, not rely on a lack of freedom to protect them.

Re: The Vietnam government has banned rooted phones from using any banking app

#449

Post by [deleted] »

Melonai wrote: post #434
2OEH8eoCRo0 wrote: post #421

Earlier quoted context omitted.

"I don't like Bonzi Buddy so people should be prevented from installing it."

Okay, it is a full on spyware virus though, not super sure why people would love Bonzi on their system. This is kind of a shitty compromise, the second you leave a tiny crack open in the security, maybe through root access, maybe some better sideloading, somehow people WILL be tricked into installing malware, and it baffles me... I've seen it happen multiple times with my older (and younger, though less often) relati…

[deleted]
Post reply on HN