Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

511–520 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#511

Post by TeMPOraL »

lxgr wrote: post #391
ploxiln wrote: post #365

Earlier quoted context omitted.

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.

> everyone will need at least a cheap-ish android or iphone, perhaps $300 No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation. Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days...…

There's a second layer to the conflict here, in that (e.g.) the banks will want to move the entire flow into whatever secure device, enclave, or "agent" they supply - meanwhile, the whole point of me having a general-purpose computer is to be able to do general-purpose computing that I want within this flow.

My favorite, basic example is this: I'd like to create my own basic widget showing me my account balance on my phone's home screen. Doesn't have to be real-time, but accurate to +/- few minutes to what the bank app would say when I opened it. It has to be completely non-interactive - no me clicking to confirm, no reauthorizing every query or every couple hours. Just a simple piece of text, showing one number.

As far as I know it, there's no way of making it happen without breaking sandboxing or otherwise hacking the app and/or API endpoints in a way that's likely to break, and likely to get you in trouble with the bank.

It should not be that way. This is a basic piece of information I'm entitled to - one that I can get, but the banks decided I need to do it interactively, which severely limits the utility.

This is my litmus test. Until that can be done easily, I see the other side (banks, in cooperation with platform vendors) overreaching and controlling more than they should.

The point of the exercise isn't to just see the number occasionally; I can (begrudgingly) do that from the app. The difference here is that having the number means I can use it downstream. Instead of a widget on the phone screen, I could have it shown on a LED panel in my home office or kitchen[0], or Home Assistant dashboard. Or I could have a cron job automatically feeding it to my budgeting spreadsheet every 6 hours. Or I could have an LLM[1] remind me I've spent too much this week, or automatically order a pizza on Saturday evening but only if I'm not below a certain threshold. Or...

Endless realistic, highly individual applications, of a single basic number. The whole point of general-purpose computing empowering individuals. If only I could get that single number out.

--

[0] - Why would I want that is besides the point.

[1] - E.g. via Home Assistant.

Re: The Vietnam government has banned rooted phones from using any banking app

#512

Post by tabiv »

schmuckonwheels wrote: post #308
squibonpig wrote: post #297

Earlier quoted context omitted.

I mean, did it do 80% of the stuff? Devices have changed a lot.

It did, and some of the things it was more effective at. I remember BlackBerry OS 4.x (?) had a built-in password manager app and this was in the mid-2000s. By comparison this was added to iOS 18 in 2024. What it wasn't good at was things like games and toxic consumer rich media bullshit. The industry saw dollar signs with iOS and Android and never wrote apps for the ecosystem. Remember the days when Instagram was iO…

You may be intetested in this, if you haven't seen it already.

https://crackberry.com/clicks-communicator

Re: The Vietnam government has banned rooted phones from using any banking app

#513

Post by basilikum »

morshu9001 wrote: post #489
basilikum wrote: post #148

Earlier quoted context omitted.

> SIM-swapping has been a tactic used. Adding difficulty for fraudsters to trick unsophisticated banking customers is a valid security layer. You fight SIM-swapping by outlawing the moronic practice of using SMS for anything security sensitive. Not by blocking user modified OSes.

What's the alternative that regular people will understand how to use and not get locked out of?

TOTP is pretty standard. Give the user backup codes and just use normal recovery methods. For most things that might be email. For a bank it's probably identity verification.

Re: The Vietnam government has banned rooted phones from using any banking app

#514

Post by array_key_first »

pix128 wrote: post #231
array_key_first wrote: post #153

Earlier quoted context omitted.

Intuitively I'd say no, there's no way it's a significant amount of fraud. Number one because, as you said, it's rare, but number two because you just don't need a rooted phone to scam someone. You can very easily scam people on perfectly legitimate phones and with perfectly legitimate apps.

Keyloggers would be considered a form of fraud, right? Customers can be protected by not allowing rooted phones which may contain malware and steal credentials, but then again Windows is a nightmare for security and nobody is banning banking from Windows.

Right, but you don't need a rooted phone to keylog someone. You can just ask their password over the phone, and people do, and it works. Or, you can install a plethora of perfectly legitimate remote access apps available on the play store.

Re: The Vietnam government has banned rooted phones from using any banking app

#515

Post by themafia »

Sophira wrote: post #502
xeonmc wrote: post #387

Earlier quoted context omitted.

If buying is not owning, pirating is not stealing. Piracy isn’t merely a virtue, but a moral imperative, an obligation to uphold civic freedom. It is immoral not to pirate. It is everyone’s duty to do their part in normalizing and encouraging piracy.

Pirate... what? A phone? Android? Banking apps? The problem here isn't the money, it's the lack of privacy and control. The best analog I can think of to piracy in this situation would be rooting the phone/installing GrapheneOS. And, yeah, that's definitely something people should do if they want that control, but I really hope people don't put it in the same category as piracy...

What makes a phone a viable consumer device is the baseband controller. The majority of that complexity lies in the software on the controller and not in the hardware the implements it.

How many companies even produce these controllers?

Re: The Vietnam government has banned rooted phones from using any banking app

#516

Post by fhdkweig »

gcuvyvtvv6 wrote: post #477
gonzalohm wrote: post #472

Earlier quoted context omitted.

You can just use your bank's website. No need for two phones

My bank turned their website off. Mobile app only now.

Care to name and shame that bank? I would like to avoid any bank that doesn't use a website.

Re: The Vietnam government has banned rooted phones from using any banking app

#517

Post by astafrig »

TeMPOraL wrote: post #511
lxgr wrote: post #391

Earlier quoted context omitted.

> everyone will need at least a cheap-ish android or iphone, perhaps $300 No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation. Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days...…

There's a second layer to the conflict here, in that (e.g.) the banks will want to move the entire flow into whatever secure device, enclave, or "agent" they supply - meanwhile, the whole point of me having a general-purpose computer is to be able to do general-purpose computing that I want within this flow. My favorite, basic example is this: I'd like to create my own basic widget showing me my account balance on my…

Up Bank provides an API that enables these use cases: https://developer.up.com.au/

Re: The Vietnam government has banned rooted phones from using any banking app

#518

Post by themafia »

phantom784 wrote: post #173
ErroneousBosh wrote: post #167

Earlier quoted context omitted.

What's a mobile deposit and why do you need an app to check it?

It's the ability to take a picture of a check and deposit it into your account that way, vs having to take the check to an actual branch of a bank. Here in the US, I still get checks frequently enough that it's nice to have.

What's hilarious is that at the end of the day your transaction is added to a text file and sent along with the image to the Federal Reserve Bank Clearinghouse via SFTP. It's then communicated back to the other bank in the exact same way.

Re: The Vietnam government has banned rooted phones from using any banking app

#519

Post by themafia »

ljm wrote: post #78
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Depends on what country you're in. In the UK, the banks are often held liable for various scams that involve the transfer of money, so they up the security over and over again. A bank will rightly argue why it's responsible for an old granny sending her life savings to her new lover in Namibia, so it seeks to block that transaction in the first place. Some of that liability is fair but most of it is the government te…

> so they up the security

They're upping the surveillance, not the security, quite demonstrably.

This is meant to protect /them/ from liability and not /you/ from loss.

Re: The Vietnam government has banned rooted phones from using any banking app

#520

Post by anothermoron »

FpUser wrote: post #463
andy99 wrote: post #423

Earlier quoted context omitted.

My (Canadian) bank extorted me into installing their app, literally blocking me from doing transfers of my own money without it - I had to install it and take a picture of myself and my ID. After this I was able to switch to sms authentication and delete it, but they’re obviously trying to force people onto the app, and eventually they will do so more aggressively. Of course in Canada we have a banking oligopoly that…

May I ask what bank? I use CIBC and RBC. They do not require any apps on the phone to reach whatever services they offer. I use all my work on desktop. I did install app from CIBC for one single and the only purpose - deposit cheques sent to me by clients to my business account without having to go to ATM or the bank teller.

[dead]
Post reply on HN