Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

481–490 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#481

Post by macbem »

thewebguyd wrote: post #444
ploxiln wrote: post #365

Earlier quoted context omitted.

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.

Nah, if a bank or some other civic entity wants to have a "secure agent" for transactions/communication with me, then they should be the ones providing that. Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work. I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.

And exactly who's going to pay for that?

Re: The Vietnam government has banned rooted phones from using any banking app

#482

Post by Zak »

browningstreet wrote: post #147
Zak wrote: post #132

Earlier quoted context omitted.

I'd be really interested to know whether a significant amount of fraud and fraud attempts involve devices with root or non-stock operating systems. This has always struck me as a matter of checkbox compliance rather than a commonly-exploited attack vector, though I'll grant that's partially because few people actually use such devices.

I worked in fraud compliance architecture at a bank.. they didn't checkbox anything. They had a lot of gathered data and justification for the limits they enabled. I'm sure not every bank does it that way, but they weren't trying to limit legit customer access, and they pained at enforcing limitations like this.

Can you share what limits they did and did not impose?

Re: The Vietnam government has banned rooted phones from using any banking app

#483

Post by thewebguyd »

macbem wrote: post #481
thewebguyd wrote: post #444

Earlier quoted context omitted.

Nah, if a bank or some other civic entity wants to have a "secure agent" for transactions/communication with me, then they should be the ones providing that. Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work. I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.

And exactly who's going to pay for that?

The issuing entity. They want a "secure device" to do business with me, then they get to issue said device.

Otherwise, they just get to be OK with offering me a website or letting me transact with them on my own device that's under my own control without stipulations like requiring attestation, or prohibiting root.

The point is, governments nor banks or other private entities, should be getting to dictate what can and cannot be done on someone's computing device.

Re: The Vietnam government has banned rooted phones from using any banking app

#484

Post by netsharc »

OutOfHere wrote: post #111

Why can't rooted phones pretend to be non-rooted phones for the purpose of certain apps? What's the point of rooting if you can't even selectively pretend?

If this pretending works 100%, then a malware can use that technique to pretend that the phone is secure, to trick you into using your bank app and steal your money anyway.

I also prefer to own my device and be root on it, while installing all the "pretend I'm non-rooted" functionality on it, I did think "this is basically installing a rootkit to tell the OS 'yes, I'm clean!'.". Then my bank (fuck them very much) decided to add a check for a locked bootloader and refused to work without it. I suppose maybe there's a way for the "rootkit" to lie and say "Yes the bootloader is locked!"?

I didn't read all the comments, but it seems to have been lost that it's a fight between freedom (allowing people to "own" their devices) and protecting the general public from harm (being scammed and losing all their money). We also have to give up some freedoms, eg. we are forced to wear helmets or seatbelts as participants of traffic, to ensure a better protection.

Re: The Vietnam government has banned rooted phones from using any banking app

#485

Post by d3nit »

Elfener wrote: post #29
Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

In Hungary, where the central bank created the same rule about not allowing banking apps on "unoffical" devices, they do, but you need either the app or SMS for 2FA. Apparently they consider SMS secure...

Tbh it's way less annoying, than I tought when they introduced.

Re: The Vietnam government has banned rooted phones from using any banking app

#486

Post by nitwit005 »

jacobthesnakob wrote: post #220
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Normiefication. Normies do everything on their phones; it’s the companies meeting the masses where they are. I’ve seen people fight for their lives to do a spreadsheet on their phones when there’s a laptop they own gathering dust less than 50 feet away.

Possibly, but companies seem strangely set on getting people to install apps, even when the feedback is negative.

Offering a monetary reward for installing apps seems fairly common. Chevron had someone at my gas station offering something like $5 of free gas, plus $1 a gallon off of the next three purchases. If it was something the customers wanted, they wouldn't need to pay people to do it.

Re: The Vietnam government has banned rooted phones from using any banking app

#487

Post by roenxi »

lxgr wrote: post #391
ploxiln wrote: post #365

Earlier quoted context omitted.

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.

> everyone will need at least a cheap-ish android or iphone, perhaps $300 No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation. Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days...…

In principle I'm certainly on board with the idea, but the problem is - at least in the Anglosphere, probably further - that the financial system is part of the military and policing systems. They are a powerful and persistent lobby that want a phone to be able to provide enough who-what-when-where to be able to put someone in jail or in extreme cases drop a missile on them.

That is one of the reasons the crypto market is behaving like some radical innovation instead of just a group of bozos speedrunning financial history. For the first time since the invention of capital we have an asset class where it doesn't take the cooperation of a group of armed thugs to guarantee the integrity of the system.

Re: The Vietnam government has banned rooted phones from using any banking app

#488

Post by morjom »

Stagnant wrote: post #177
drnick1 wrote: post #150

Earlier quoted context omitted.

To be fair, this seems to be mostly a European problem. U.S. banks do not seem to enforce Play (dis)Integrity.

Not necessarily an european problem either. Maybe It varies by country but at least none of my 3 finnish banks check for play integrity.

I know OP checks for integrity/for third party apps. My guess for your ones would be Nordea, Danske and S?

Re: The Vietnam government has banned rooted phones from using any banking app

#489

Post by morshu9001 »

basilikum wrote: post #148
linkregister wrote: post #121

This is likely part of the Vietnamese and Thai governments' rollout of biometric linking for bank accounts, similar to KYC regulations in the United States. The deadline for Vietnamese biometric linking was December 19th, 2025 [1]. The Vietnamese government has reported a rise in account takeovers and other banking thefts [2]. SIM-swapping has been a tactic used. Adding difficulty for fraudsters to trick unsophistica…

> SIM-swapping has been a tactic used. Adding difficulty for fraudsters to trick unsophisticated banking customers is a valid security layer. You fight SIM-swapping by outlawing the moronic practice of using SMS for anything security sensitive. Not by blocking user modified OSes.

What's the alternative that regular people will understand how to use and not get locked out of?

Re: The Vietnam government has banned rooted phones from using any banking app

#490

Post by IshKebab »

browningstreet wrote: post #147
Zak wrote: post #132

Earlier quoted context omitted.

I'd be really interested to know whether a significant amount of fraud and fraud attempts involve devices with root or non-stock operating systems. This has always struck me as a matter of checkbox compliance rather than a commonly-exploited attack vector, though I'll grant that's partially because few people actually use such devices.

I worked in fraud compliance architecture at a bank.. they didn't checkbox anything. They had a lot of gathered data and justification for the limits they enabled. I'm sure not every bank does it that way, but they weren't trying to limit legit customer access, and they pained at enforcing limitations like this.

Yeah I call bullshit. The number of people with rooted phones is going to be way less than 1%, and the number of those that are unsophisticated enough to fall for scams/malware is going to be miniscule.

This is pretty clearly a case of "oh there's an option here that says 'allow on rooted phones', do we want to allow that?" "No that sounds scary and risky! Of course not. We must not allow it."

The option is there, and nobody is going to try to sell not ticking it.

Post reply on HN