Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vietnam government has banned rooted phones from using any banking app

xdaforums.com

Post reply on HN
Print view View original

71–80 of 643 posts

Re: The Vietnam government has banned rooted phones from using any banking app

#71

Post by lucasban »

NiloCK wrote: post #40
taosx wrote: post #5

I really don't understand this. My line of thinking is that if someone is technical enough to root his phone he understands the risks. Why would they force banking apps to detect and not work on rooted phones? Why would the government care so much?

A rooted phone is more capable of modifying the banking app itself and has 'freer reign' over the APIs that the app uses to interact with the bank. Whereas previously the app displays a 'whitelisted' set of UI options to the user, the rooted user could use employee only methods. Somewhere or other every bank has methods that set balances on accounts. To be honest a law like this makes security by the extremely modest…

This should be enforced by the backend, why should you ever trust the client to tell you what access you have?

Re: The Vietnam government has banned rooted phones from using any banking app

#72

Post by immibis »

eastbound wrote: post #60
varenc wrote: post #25

Earlier quoted context omitted.

I assume the bank apps have functionality that their websites lack. Like being able to tap to pay for things, etc. Where a rooted phone might make fraud easier. If not, then this really makes no sense.

The only way an app can contact a company is through REST APIs.

True. All internet packets are REST API packets - there's no other type of packet. And all cell radio traffic is internet packets (which are REST API packets).

Re: The Vietnam government has banned rooted phones from using any banking app

#73

Post by marssaxman »

silisili wrote: post #62
dingaling wrote: post #8

Earlier quoted context omitted.

Eventually though I suspect that web access to banks will be rescinded too, much like HMRC in the UK no longer permits companies to submit their taxes through the websites. In the future, everything will need an 'app'.

That seems to be the way the wind is blowing. Most new 'challengers' I've tried in the US either have no web access at all, or limited access that lets you view balance but not do things like transfers.

I long ago decided never again to use anything but a credit union, and this makes me glad that credit unions tend not to ride the forefront of tech trends.

Re: The Vietnam government has banned rooted phones from using any banking app

#74

Post by bugbuddy »

tux3 wrote: post #35
Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

This is a very condescending toward Vietnamese tech people. According to Twitter/X, Vietnam’s GDP just surpassed Thailand and it’s on its way to joining the Great East Asian prosperity zone by becoming the last country to become fully industrialized and very rich. Many tech jobs in the US will move to Vietnam in the coming few years. You will be surprised where your future Tech conferences will be located.

Re: The Vietnam government has banned rooted phones from using any banking app

#76

Post by Barbing »

silisili wrote: post #62
dingaling wrote: post #8

Earlier quoted context omitted.

Eventually though I suspect that web access to banks will be rescinded too, much like HMRC in the UK no longer permits companies to submit their taxes through the websites. In the future, everything will need an 'app'.

That seems to be the way the wind is blowing. Most new 'challengers' I've tried in the US either have no web access at all, or limited access that lets you view balance but not do things like transfers.

Recalling Venmo winding down web beginning in… let’s see… 2018!

https://www.digitaltrends.com/phones/venmo-shutters-web-plat...

Re: The Vietnam government has banned rooted phones from using any banking app

#77

Post by adrr »

tux3 wrote: post #35
Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Bunch of fintechs only let your signup from an app. Easier to secure and prevent bots. Pin certs, detect virtualization, etc.

Re: The Vietnam government has banned rooted phones from using any banking app

#78

Post by ljm »

tux3 wrote: post #35
Arbortheus wrote: post #4

Do those same banks have websites that you can access from a computer with root access? Most likely, yes.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Depends on what country you're in. In the UK, the banks are often held liable for various scams that involve the transfer of money, so they up the security over and over again. A bank will rightly argue why it's responsible for an old granny sending her life savings to her new lover in Namibia, so it seeks to block that transaction in the first place.

Some of that liability is fair but most of it is the government telling the banks to account for the loss when someone is scammed. They are obviously going to mitigate that as much as they can.

Re: The Vietnam government has banned rooted phones from using any banking app

#79

Post by hyghjiyhu »

cons0le wrote: post #65
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Yep, hardware attestation is becomming more common, even with websites. This is why LineageOS is actually dead in the water, even though they're "in talks with hardware vendors". It doesn't matter when people can't use the apps and services they need.

A solution could be having a tiny non-rooted Android system as a "coprocessor".

Re: The Vietnam government has banned rooted phones from using any banking app

#80

Post by lenerdenator »

adrr wrote: post #77
tux3 wrote: post #35

Earlier quoted context omitted.

There's a trend of online banks forcing the use of an app. I can't login to one of my banks' website since last year without using a QR code from their app. Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful. Anyways, they're not yet at the point where they've…

Bunch of fintechs only let your signup from an app. Easier to secure and prevent bots. Pin certs, detect virtualization, etc.

And, of course, easier to get the valuable data about the person setting up an account.
Post reply on HN