Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

631–640 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#631

Post by ymyms »

zozbot234 wrote: post #235
ymyms wrote: post #200

Earlier quoted context omitted.

I wonder if this makes room in the market for some simpler device for payments. Something like a wearable that you can tap-to-pay and has the signed software attenuation but nothing else so you can't be tracked using GPS.

> Something like a wearable that you can tap-to-pay and has the signed software attenuation but nothing else so you can't be tracked using GPS. That's a nice idea. You could have a simple card-shaped device with no screen or buttons, and call that a "credit card".

Heh yeah, my comment does kinda scream credit card. What I really mean is something programmable for narrow use-cases like multiple forms of payments, transit, or other stuff like building access.

Re: The Vietnam government has banned rooted phones from using any banking app

#632

Post by pie_flavor »

bigstrat2003 wrote: post #461
pie_flavor wrote: post #383

Earlier quoted context omitted.

Because when you don't do this, people get scammed out of money. If there is a series of buttons you can press to circumvent the anti-scam measures, then the scammers simply walk you through pressing those buttons. If you cover them in giant warning labels the scammers simply add explanations into their patter. The buttons must physically not exist, for gullible people to not get scammed out of money. The next respon…

> Because when you don't do this, people get scammed out of money. I don't care. Society doesn't exist to keep people safe from their own bad decisions.

They represent more of the customer base, and a larger voting bloc, than tech nerds. You can offer your opinion of what society exists for, and the rest of society doesn't have to listen to it. The only actual leverage tech nerds who aren't billionaires have is when the particular ones who work for Google are asked to implement these features.

Re: The Vietnam government has banned rooted phones from using any banking app

#633

Post by mike_hearn »

izacus wrote: post #602
mike_hearn wrote: post #595

Earlier quoted context omitted.

Regulators love vague standards like "inadequate protection" because it means they can implement a ratchet effect without needing to understand anything or constantly rewrite the laws. If someone gets hurt they just look around at whatever the competition is doing, pick the most extreme thing, and declare that any other standard is inadequate. So sure, if you want to not use security tactics your competitors are usin…

Yeah, so you admit there's no real legal basis for those kind of restrictions. Which anyone of us who worked with banks, mobile, banking security and their legal already knew. They're a source of greatest security hits like "let's use SMS for only auth for web banking" after all. But what's really hiding behind all your fluff is something else: Abusing users with root lockouts is EASY for the programmers at banks. Th…

The regulations are the "real" legal basis. The fact you don't like them or how they're written doesn't make them any less real. And you're not arguing with me or my "fluff", you're arguing with the entire banking industry.

If you really think this is all just fluff, by all means, go get yourself employed inside a bank's security team and convince them to turn all this stuff off. Let us know how it goes.

Re: The Vietnam government has banned rooted phones from using any banking app

#634

Post by skylurk »

AlexeyBelov wrote: post #627
skylurk wrote: post #510

Earlier quoted context omitted.

> We shouldn't be protecting someone that gullible My uncle, an engineer, was scammed out of his life savings last year. He was a smart guy, he just got older.

Well, not very smart.

Really makes me hope my heart cuts out before my mind does.

Re: The Vietnam government has banned rooted phones from using any banking app

#635

Post by reyqn »

miki123211 wrote: post #562

The point of blocking rooted devices often isn't to protect your account, it's to protect other (often unsophisticated) customers of the organization against automated attacks. Rooted devices aren't the problem, Python scripts pretending to be rooted devices are. There's just no way to distinguish between the two. The only way to disallow automated Python scripts from logging to your grandma's bank account is to also…

What stops people designing those automated attacks to run the python script on a phone that is blocked by Google?

Re: The Vietnam government has banned rooted phones from using any banking app

#636

Post by ecshafer »

kccqzy wrote: post #141
ecshafer wrote: post #119

When I used to work on the Vanguard authentication team, we blocked Vietnam from access because of too much fraud (not my choice). But it was funny because we had Vietnam based clients, so there were a couple HNW clients in the logs that you could see who would log in from Vietnam/Russia/Wherever, get blocked, open their vpn, then log in from England. This was a while back, but even then there was a push for things l…

Oh yeah I remember adding my Yubikey to Vanguard as early as 2019! It felt amazingly modern compared to any other bank. I assume this is your or your team’s work. Thank you! I’ve also had other banks do the same. They provided me with a debit card that supports international transactions but they did not allow logging in from most Asian countries. So I would log in from Asia, be blocked, turn on my VPN and log in fro…

Yeah I was on the team that had yubikey working. It was kind of a pain because we had to support some ancient IE versions and Yubikey basically only worked on Chrome at the time IIRC.

> I’ve also had other banks do the same. They provided me with a debit card that supports international transactions but they did not allow logging in from most Asian countries. So I would log in from Asia, be blocked, turn on my VPN and log in from the U.S. to check the balance on my card.

Yeah it was kind of complicated. We blocked high fraud countries to just get rid of this low level fraud and port scanning. But if someone was actually a customer, then that was fine, it was just assumed they would know how to use a VPN and they're going to get everything verified. There's also some KYC rules that I am not too familiar with that it just became considered okay at that point.

Re: The Vietnam government has banned rooted phones from using any banking app

#637

Post by dwaite »

lxgr wrote: post #391
ploxiln wrote: post #365

Earlier quoted context omitted.

I think, practically, everyone will need at least a cheap-ish android or iphone, perhaps $300 (and a new one every few years ...), to be their locked-down "agent" for using financial or government services. It's not for you, it's for the government/banks, it is their agent for talking to you. Kinda weird, if you think about it. But that seems to be the way it's heading.

> everyone will need at least a cheap-ish android or iphone, perhaps $300 No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation. Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days...…

> No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation.

Thats what is being required. The problem is making sure the policy is enforced correctly includes local business logic and user experience components. The money transfer needs to come from an authenticated user providing consent, not from some software that happens to have managed to get installed on the phone with sufficient permissions to interface with the secure element or to have their version of a library loaded.

That means one needs to validate user-facing software, and not just the API to a black box. Thus one is requiring a chain of custody validation up to the boot loader.

Re: The Vietnam government has banned rooted phones from using any banking app

#638

Post by itake »

Zak wrote: post #594
itake wrote: post #561

Earlier quoted context omitted.

I work at Grab (SEA rideshare and licensed bank, but not licensed in VN). A significant amount of fraud comes from scammers convincing victims to installed malicious apps. They fake being a customer service provider. Banks don't want their customer's to lose their money and they don't have the tools to protect them from themselves. For all the privacy reasons, app stores don't even banks enough tools to identify and…

Tricking someone into installing a malicious app usually doesn't involve them having a third-party or modified operating system on their phone. I'm asking about that because I believe it's a hypothetical risk rather than a problem in practice and I'm curious about any evidence to the contrary.

Just a random example,

Drivers buy modified versions of our mobile app, because they think it will give them advantages over other drivers. These apps are side-loaded (not published in the app store).

Re: The Vietnam government has banned rooted phones from using any banking app

#639

Post by Zak »

itake wrote: post #638
Zak wrote: post #594

Earlier quoted context omitted.

Tricking someone into installing a malicious app usually doesn't involve them having a third-party or modified operating system on their phone. I'm asking about that because I believe it's a hypothetical risk rather than a problem in practice and I'm curious about any evidence to the contrary.

Just a random example, Drivers buy modified versions of our mobile app, because they think it will give them advantages over other drivers. These apps are side-loaded (not published in the app store).

Thanks for the additional detail. Do those apps actually give them advantages, or are they scams/malware?

I wasn't asking about sideloading apps though. I was asking about modified operating systems like LineageOS and GrapheneOS, or root via OS modifications like Magisk and KernelSU.

Re: The Vietnam government has banned rooted phones from using any banking app

#640

Post by Barbing »

Macha wrote: post #296
pluralmonad wrote: post #282

Earlier quoted context omitted.

I don't understand either. My contact surface with my bank is so small. I log in once a month to download transactions. What is everyone doing that they need constant immediate access on their phones? I'd probably debank before buying a special iPhone to access a bank account.

Let me give you a preview of a world coming to you, and present day reality in Ireland: 1. Your employer pays your salary by bank transfer, which requires you to have a conventional bank account. 2. You then want to spend that money, how do you do that? Debit card? You need the phone app to retrieve the PIN when the bank first sends you the card. Cash withdrawals in the branch? For amounts less than €10,000, the staf…

Ew. Thanks for sharing
Post reply on HN