The other more compelling reason why people would have a rooted phone is to run ROMs that may still be providing OS support where the stock OS has been abandoned or EOL'd by the developer.
Having an unlocked bootloader at the minimum would be required in those scenarios. It actually saves hardware that still works from ending up in landfills.
edit: spelling
Incidentally, if anyone wants some collector's edition Google/Android devices...
Please get in touch with the postmarketOS folks, since any phone old enough to be running CyanogenMod proper is most likely not supported there yet. (It would be super nice to even have a proper list of all devices where old CyanogenMod was officially supported at some point, with device specs for each. We're lacking even that at present because the transition from the CyanogenMod name to LineageOS was so messy.)
Of course, the combination of extremely limited hardware specs (512MB RAM + 512MB built-in storage was a common spec), old ARM32 SoCs and the ongoing 3G/2G mobile network phaseout means that many such devices will only really be useful as glorified palmtops or for even more minimal uses. But it might be worth experimenting with nonetheless.
(The first time I walked past a homeless person using a VR headset, on the other hand, was a fucking trip.)
All other business, including personal communications, conducted on a GrapheneOS device. These days you don't even need a phone number for your everyday device, a data-only roaming plan like silent.link is enough. This is not yet necessary in the U.S., but we are dangerously close.
I utterly detest the idea of having to use a phone for anything that I'd like to be secure. I browse Reddig on that thing. I watch porn on that thing, I don't want my porn anywhere near my bank account.
That sounds like a utopia we've passed by on our way here. Maybe it's possible to make such a dedicated hardware device when the digital wallet becomes available for a (mobile) linux distribution or a degoogled android. Let's see when the phone manufacturers think that's a good idea to lobby for
I'm cynical about the whole digital wallet idea because of this. Not that it's not useful, but it's tying your mobile surveillance unit and browser history to an identity on hardware that you are not meant to control
In the future, everything will need an 'app'.
It’s not like the UK sent out a mandate to private banks or any other private industry on this issue. It’s also only one small country of hundreds.
I’d have to question this idea that this is how things “already look.” I can think of very few businesses that I interact with that force me to use an app.
I have had a lot of banks and credit cards, mobile payment apps like Venmo/PayPal in the US and they almost all work on mobile web and desktops.
But I recognize that wealthy western countries didn’t really skip the personal computer like many mobile-first regions have done.
I've heard 3rd hand of some banks already doing this in i.e. Armenia where a foreigner can come in and open account easily but they block any online access to lock the control of funds in country to make it harder for the FATF psychopaths to find fodder to clamp down on them.
No no no shut up, don’t speak up. No one thinks like you.
Most people would find this viewpoint to be strange.
They'll find a solution to their problem, which is you: apologize for losing you as a customer, and express a hope that you'll consider them again after you've bought a phone.
https://www.digitaltrends.com/phones/venmo-shutters-web-plat...
Most banks charge a fee for sending a wire. Sending an ACH is free, but most restrict that to your own account. Revolut is the only one I've seen that lets you just spam ACH to anyone. In both cases, it isn't instant.
Zelle largely fixes those issues, but has its own issues, like a lot of banks not supporting it and/or arbitrarily low send limits.
1. Your employer pays your salary by bank transfer, which requires you to have a conventional bank account.
2. You then want to spend that money, how do you do that?
Debit card? You need the phone app to retrieve the PIN when the bank first sends you the card.
Cash withdrawals in the branch? For amounts less than €10,000, the staff will direct you to the ATMs in the branch. These require an activated debit card to withdraw money, and activating that card requires the phone app.
Manual money transfers in the branch? Once again, for amounts less than €10,000, the staff won't do it - they'll instead direct you to the PCs in the branch. These are just loading the same website you can access on yours, which will ask you to the confirm with a 2FA push notification to log in.
Try another bank? The legacy banks all got the same auditor who advised them that app based 2FA is the easiest way to implement PSD2, and reduce the likelihood they get held liable when customers get scammed, so they all implemented that as the only option. The neobanks of course, are accessed solely by apps.
Users are losing billions worldwide due to fraudulent apps. If a user has root and runs a malicious app, it can intercept what a legitimate banking app does. A scam app with root can draw over the screen and tell users to transfer money, or it can run a series of actions when the banking app is running, or do any of a hundred things to steal money.
Sure. But the people who are actually rooting their phones are advanced users and aren't going to install a malicious custom OS. Are naive users getting tricked into rooting their own phones? I'm dubious what the security benefit is of this decision.
There are two ways to root a phone:
1. Unlock the bootloader, install a well designed and highly secure aftermarket OS, relock the bootloader. The device is still just as secure against malware as it was before. Remote attestation shows the vendor that you're running Graphene or Lineage or whatever.
2. Exploit a local vulnerability to drop a sudo binary somewhere. RA shows you're running an exploitable version of Pixel Android, etc.
(2) is absolutely exploitable by fraudsters. They convince the user to run an app or visit a website that exploits their browser or whatever, and the vulns are used to escalate to root and keep it. Now when the user logs into their banking app the HTTP requests are rewritten to command the bank to send money to the adversary. This is why devices that allow escalation to root are excluded via remote attestation.
(1) isn't but it requires more coordination than the industry has proven capable of so far. Binary images of a custom OS could in theory be whitelisted by banks if it was known to be as secure as other operating systems. But there's no forum in which that information can be exchanged. Like, RandOS turns up and the maintainer "xyzkid", identity: anime avatar, claims his OS is super secure. How does random overworked bank developer John Smith know if this is true or not? RandOS doesn't come with any audits, it doesn't have a well paid security team. The brand is a big question mark. And if John makes the wrong call, maybe the bank is now on the hook for millions in losses because someone installed RandOS to get the shiny icon theme or whatever, and then got hacked.
So it's a hard problem. It's not actually a technical problem. Remote attestation is very general. The hard part isn't the tech. It's a social problem. How do you create and rapidly communicate trust in a new binary OS image if you don't have the security resources of an Apple or a Google or a Samsung? Google runs a whole accreditation programme for Android where you can turn up as a phone OEM and get your custom OS builds considered to be secure by passing a huge test suite. So the only issue is OS hackers who fall below the threshold where they can do that.
There's an alternative of course: go full libertarian. Means, just use a "bank" that doesn't care if its users get hacked. This is what the Bitcoin community enabled. It's there if you want it.
Well it’s more the Dunning Krugerites who see the word “rooting” written by someone in a cyber context, lack that context entirely, and proceed to enter the discussion anyway based on their experience rooting their Android phone 3 years ago after clicking through a few UI buttons.
On android, I believe this can be done rootless via accessibility permissions that can display on top of apps
While they (mostly) have websites, a computer with root access is not sufficient by itself to access them. You also need to perform 2FA via push notification to a proprietary app on an Apple or Google approved device.
From they you can keylog. Highjack input listeners, basically do anything you want.
There's not even that many people using rooted phones, and many are tech savvy people that are generally a bit more careful, so even if a rooted phone gets infected by some malware chances are the malware won't even be written in such a way to try to obtain root permissions through the standard procedure and exploit it.
on the other hand phone does not require you to verify with your pc, so there's no second factor unless there is some unacessible secure island within the phone itself.
funny enough, you can probably use that website directly on the phone that you use as 2F, which probably circumvents the 2F idea (at least as long as you use SMS 2F instead of app that checks for root)
Of course they slathered the app with tracking, 'security', and analytics SDKs, so rooted devices are rejected. I had no way to log into this bank account after they made that change, which is simply wonderful.
Anyways, they're not yet at the point where they've learned to do the checks server-side. For now it's a one line patch to skip the root screen. But the Play Integrity API is designed correctly, if they learn to use it, there will be no workaround without someone finding a hardware vulnerability somewhere.
This is why LineageOS is actually dead in the water, even though they're "in talks with hardware vendors". It doesn't matter when people can't use the apps and services they need.
https://en.wikipedia.org/wiki/Web_compatibility_issues_in_So...
> Many tech jobs in the US will move to Vietnam in the coming few years.
It would seem to me that India has that on lock.
Some of that liability is fair but most of it is the government telling the banks to account for the loss when someone is scammed. They are obviously going to mitigate that as much as they can.
Go back fifteen years and malware is absolutely submitting bank transactions after the user does a 2FA.
https://krebsonsecurity.com/2010/03/crooks-crank-up-volume-o...
They're upping the surveillance, not the security, quite demonstrably.
This is meant to protect /them/ from liability and not /you/ from loss.
I chose my current bank because it was one of the few that had proper token based access for 3rd party integration. An overwhelming majority of banks were relying on a 3rd party holding your actual username/password and saying "trust me bro". I wasn't comfortable with that.
We're dragged into this kicking and screaming and yet normies think we're the crazy ones.
Offering a monetary reward for installing apps seems fairly common. Chevron had someone at my gas station offering something like $5 of free gas, plus $1 a gallon off of the next three purchases. If it was something the customers wanted, they wouldn't need to pay people to do it.
I believe that previously internet banking, even before mobile banking, will limit the number of transfer recipients you can add per day/month. With the rise of QR payment I could see this limit being regularly hit if you scrape the web-based banking.
Since the Bank of Thailand claims that they technically don't block many things (mobile banking technical requirements seems to also require blocking root, but they never banned internet banking), I wish there's a new bank that try to disrupt the existing players. But the latest "branchless" banking license were only acquired by existing banking groups, so API-first personal banking remain impossible.
The banks that allow you to do everything on their website trend towards legacy and US-centric.
banking is very risk averse area. and it is good precaution.
My guess is:
1. Person with rooted phone uses a bank app, is hacked, has their money stolen.
2. Guess where the person turns to for help? The government.
I'm not saying its impossible but it is hard to do at present in a way where if I came and picked up my phone again, I'd not know something happened to it.
Whereas previously the app displays a 'whitelisted' set of UI options to the user, the rooted user could use employee only methods. Somewhere or other every bank has methods that set balances on accounts.
To be honest a law like this makes security by the extremely modest obscurity of not having an "increase your balance" button on the app UI much more tempting.
Exposing these types of APIs in any way outside the bank ever would be gross negligence.
I wonder if this has become a feasible avenue for scammers to interfere via other apps they could convince someone to install on rooted phones. Or if they are worried about skilled people being able to debug/MITM and find vulnerabilities on the banks.
Though from that statement alone, sounds more of a measure to protect banks than customers.
> if someone is technical enough to root his phone he understands the risks
You're looking at this from the user's perspective. Indeed, the narrative is "for your safety, you cannot export your security tokens from your device's storage" or "software that runs as root can bypass all permissions, an attacker might exploit that!", as though users can't make that choice themselves on purchased-to-own hardware. Dropping privileges (https://en.wikipedia.org/wiki/Privilege_separation) has been a thing since as long as I'm alive. Don't be fooled that this "protection" is for you :(
Kinda like the Wall Street concepts of "Accredited" and "Sophisticated" investors - who could never possibly fall for a Ponzi scammer like https://en.wikipedia.org/wiki/Bernie_Madoff ?
Not to say I'm a fan of Vietnam, or familiar with their ban - but when people are having their money stolen at scale, there's a very strong tendency to blame the gov't and/or financial system. And it's extremely rare for stolen-at-scale funds to not be "reinvested" in further criminal activities - which again, the gov't is expected to deal with.
But you do understand. If someone is technical enough to root their phone, then he is the risk.
[cough]Monero[cough]
The National Credit Union Federation of Korea (NACUFOK) represents over 800 member-owned unions (https://www.cu.co.kr/english/main.do), and then there is the even larger Saemaul Geumgo (MG) network which operates as community credit cooperatives with millions of members. These people ostensibly own their "bank" accounts.
Surely most people running a rooted phone are tech enthusiasts. Cybercriminals will just use regular phones bought under false names and dispose of them afterwards.
Users that try to use mobile apps as if they were web apps, disabling location, and security features are just flagged by numerous security mechanisms.
In other words, the correlation is that older people are more likely to have a rooted phone and are more susceptible to fraud.
Dunno how widespread this is, just something to keep in mind.
Dug it up. Alfred Whitehead:
It is a profoundly erroneous truism, repeated by all copy books and by eminent people when they are making speeches, that we should cultivate the habit of thinking of what we are doing. The precise opposite is the case. Civilization advances by extending the number of important operations which we can perform without thinking about them.
Viet Nam is in the process of rolling out mandatory biometric identification and verification as part of the VNeID project [0], and mobile operators are in the process of rolling out identity stamping if mobile devices using VNeID [1]
Viet Nam is also an authoritarian state who's current leader (To Lam) spent his entire career in Viet Nam's KGB (MPS/BCA). Unlike Westerners, Vietnamese know the red lines - this is why I and my SO (much to her chagrin due to my insistence) never travel back to VN with my personal accounts or devices, and why we keep some friends of friends on speed dial.
[0] - https://vneid.gov.vn/
[1] - https://vtv.vn/nha-mang-ho-tro-kich-hoat-sim-truc-tuyen-bang...
Vietnamese government will not arrest a tourist foreigner for talking bad about the party or about Ho Chi Minh, it would decimate their tourist bottom line. If you don't deal with drugs or actively don't organise against the party, you will be fine.
There is a growing surveillance (which you cited well) but mostly for locals.
edit: oh I misread, you are Viet Kieu, not a western tourist. OK yeah that makes some sense.
and that's enormous power for those who want to centralize power into their hands.
If someone steals the secrets from a rooted phone and steals customer's money the bank is on the hook, so banks do everything they can to minimize this risk.
There is no way to store customer's secrets in a PC browser securely, so all the "dangerous" transactions were outright prohibited in the web app or made available only via temporary QR login.
All this is just is a negative side effect of customer protection laws.
Do peope get defrauded using online banking? Sure. But usually not in a way that would be stopped by secure attestation.
For the past 20 or so years, every bank I've been with in Belgium has provided me with one of three types of hardware token:
1. An OTP token that's just a screen that displays a new 6 digit token every couple of seconds (haven't seen one of these in a few years now). This was used to supplement username/password on login and to verify every bank transfer.
2. A token with a screen and a display, which generates OTPs based on input. E.g. for a payment the bank would tell me to enter the amount + the last N digits of the bank account, the token then generates an OTP, which I can use to confirm the payment. That's what 2 of my 3 banks currently use. They have separate modes for logging in, for signing bank transfers, for signing 3D Secure online payments, etc.
3. A card reader where where I just slot in my card. I can then log in or sign payments using the card's chip & pin. This is what my third bank uses. There are a couple of variants on this, such as models which connect with USB and models which can read QR codes from your screen so you don't have to tap in anything except for your PIN.
Now that's just not true now, is it? Sure the lawyers told you that (the ones that get paid to tell you that), but nowhere in EU was a bank actually fined for not root checking a device.
They were plenty fined by being utterly incompetent with security practices and doing them poorly - like trying to inject wierd .SOs to do the root detection you're defending.
"Payment service providers (PSPs) operating in the EU will have to cover customers’ losses from fraud if their fraud protection regimes are inadequate or poorly implemented under new EU rules."
Other places like the UK had such rules already.
In some jurisdictions if bank can prove that transaction was made with customer's key then customer can not demand their money back. That's the best case, but there are only few of such jurisdictions and even there the burden of proof is on the bank and it costs a lot.
In other jurisdictions bank must reverse a transaction even if it was proven that the transaction was signed with a legitimate key, but the key _may_ have been stolen.
In some jurisdictions (i.e U.S.) banks are required to reverse a transaction at a customer’s request, even if the customer does not dispute having made the transaction.
In any case dealing with all this is too expensive and risky.
But you are providing an alibi for malicious users who, for example, might try to brute force logins from unidentified devices.
That would be one reason aside from the law. You are essentially positioning yourself on the same side as intruders.
You should personally immediately return any computing device where you have control, this line of reasoning is insane
You realize in Viet Nam this means getting a "friendly" visit by the MPS/BCA, and if you continue eventually getting branded as a troublemaker.
Hence my qualifier. I'm not trying to incite anyone into personal danger.
All public key boxes are banned and Google regularly bans new ones . That endpoint contains the list of revoked keyboxes : https://android.googleapis.com/attestation/status
They need to go further to outlaw hide root apps, and then install special app to track the status of the phone to make sure it is not rooted. Then allow police to randomly check the presence of this app on people phones. Every phone needs to be registered and pass hardware inspection every year. Even better, make so called offices where people can come and deposit or transfer money, it will be super safe.
The irrefutable part here is that the security model works. Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own hardware. The genius of the modders in that XDA thread is undeniable, but they are fighting a war against the fundamental architecture of modern trust and the architecture is winning.
1) An unmodified iPhone SE (2022 model) with OS support until 2032. This runs all my authentication, banking, health, etc. It is in airplane mode 99% of the time unless I need it.
2) The second is a Pixel 9a with Graphene OS for daily use, routing and internet access.
https://privsec.dev/posts/android/banking-applications-compa...
But nope the cryptobros just turned it into another pyramid speculation scheme and the governments ruined the customer independence with their KYC stuff. Now it's just an online version of the old system where the exchanges are the new banks.
That's a nice idea. You could have a simple card-shaped device with no screen or buttons, and call that a "credit card".
“Be kind. Don't be snarky.”
“Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.”
At the same time there was also the Exxon-Mobil Speedpass RFID fob, and I remember there being a huge discussion about “the battle of the keychain” and whose payment instrument would win being on your keys to be used the most alongside your loyalty cards.
Note that the payments are tied to a card/chip but you can (at the moment) buy new card no id/registration required
It was really like digital cash, the money was loaded onto a chip. So if you lost it you lost all the money. There was no pin code either, just like a real wallet. Unfortunately it was not really anonymous because the Dutch government are really into surveillance.
It didn't really last very long, it was only popular for parking machines. In those days 2G was expensive so validating transactions online was rare.
Like a credit card? They've been around for some time.
https://support.apple.com/guide/security/express-cards-with-...
I'm thinking a ring type device might be better--put a pulse oximeter into it, you unlock it with your phone, it remains unlocked only so long as it gets basically perfect data from the oximeter, locks if it fails for a second. Thus said robber can neither snatch your ring nor cut off your finger and use it. I like the metal mesh straps that can hold my device very snugly against my skin without being tight and that would be good enough, but a looser strap would not.
For example, do most daily transactions at one bank, and keep the rest at another.
This happens a lot in companies and government - you outsource payable operations to different division of government or a contractor. Hire one to do custody of money, another to process disbursements.
Everytime I have to use a stock phone I'm appalled at the ads and I have absolutely no trust in any US or Chinese manufacturer. So I use them only for banking and digital id because that's presumably not what they actually care about.
It's not that expensive, I think many people have an old Android phone lying around, it doesn't have to be up to date.
In reality, banks couldn’t care less. They only care about checking boxes and don’t consider where these boxes come from; every unchecked box is a risk.
Did the latest sham "security audit" say that root is bad? They'll block it.
For 2 years the voice authentication worked fine (they call me, I type in a number) on my regular rooted phone. Then one random morning I just stopped getting the phone calls. "Network said no".
Complete lock out, nothing I could do except go out and panic-buy an unrooted phone not running Lineage and using a modern Android version. (I tried my older unofficial lineage phones without root, and no dice.)
I opted for a good phone I could postmarket later, but gosh did it set me back almost 1/5 of my monthly salary.
Need? Unless and/or until the ability to log in and do your banking, healthcare, etc. via desktop/laptop goes away, then you don't need a phone to do any of that. Yes, 2FA may be required but in the tangential experience of myself, my partner and my two closest friends, we have multiple 2FA options available to us for our banking/healthcare apps that don't require a smartphone.
I see this point all the time - "You can't bank or do important life stuff without a phone!!!" and it's just, largely, bullshit. I don't do any "important life stuff" on my phone.
Beyond that, even if you had to have a phone to perform those tasks, I'd strongly argue that if you feel you need a second phone, then, and I know this will come off as reductive and unproductive, I think the idea of spending less time on your phone and on the internet, and more time "touching more grass" and interacting with the community and world immediately around you, might apply.
Notably, in Vietnam people use QR payments a lot. If you want to interact with them by, say, paying at a small local restaurant, you’ll need a phone (or a stack of cash, and please do prepare change).
So I don't, actually, need a phone in that instance...
For this to work for me personally, I would need webapps for ride-hailing and preferably food delivery, and to learn how to navigate the city without a map. I think I might be able to pull it off for some of the places I live in.
Theoretically there is a third option with USB ID card reader to use certificate stored in ID card. But I never saw one used in practice. It’s a PITA to get those devices to work on anything beyond Windows. And they’re accepted in relatively few places.
the only way to disable any transmissions is to turn off the device
Although, I am still using 17.7.2 that won't stop nagging me to upgrade to iOS 26.2.
I don't want to because I know I'll hate it.
Also found out that the profiles also expire, so you need to update those in order to skip the update nagging. Apple's lolling all the way.
I used to be under the impression that:
- Airplane Mode via Control Center icon, true.
- Cellular, WiFi, and Bluetooth off, via Settings, not true.
Meaning, if you turn those off specifically, you are not talking to towers or access points or broadcasting a persistent bluetooth ID.
Having Kagi'd a bit just now, maybe the thing that can't be turned off is NFC?
https://www.simplymac.com/ios/can-you-turn-off-nfc-iphone
If that's the case, then I'd hold this as a different threat model than not being able to turn off WiFi and Cellular.
Very curious if an iPhone or iPad with all accessible settings off, including for NFC turning off Apple Pay, NFC tag reading, etc., leaving only this background NFC on, if there are still persistent identifiers being broadcast.
The iPhone SE would be the one I use for calls, SMS, etc. It has the SIM card.
The Pixel 9a would be used for everything I don't need a data plan/SIM card (browsing etc).
My needs are a bit different from yours. I like to separate telephony and communication (i.e. WhatsApp, SMS) from everything else. This way, if I want quiet, I just turn that phone to airplane mode. I really don't want to get random pings while I'm doing "real" stuff on my phone.
Over the years, I've spent far too much time with different solutions for managing notifications, etc. Turns out simply keeping the older phone after buying a newer one was the easiest approach. No downsides so far. The old phone has the SIM card. The new one doesn't.
Also, that's only half of it. I have to move it out of "Do not disturb" at some point. Or set a timeline for it. Why should I when I just don't need to?
Also, it's been years since I used "Do not disturb". Does it show notification icons in the drawer on top? That's a definite no-no.
And with focus modes with location based triggers, you can set it to turn DND on when you get home and it automatically turns off when you leave home.
What makes you think it'll be supported for a decade? Looking at the past models, the support period is around 5-7 years. If you count security updates that might get you to 10 years, but at the 7-9 year mark apps will eventually refuse to update because you're not on the latest ios.
for my smartphone usage, i could still use my iphone se (1° gen) perfectly fine and that would include writing some pieces with garageband; which got deprecated and non-download-able because newer versions weren't aimed to my iOS version. heck the vast majority of smartphones aren't compilling software with local hardware (nor i know why someone would do)... guess we could stop with processing power advancement of 2015 just fine to run Whataspp and Instagram. producing hardware is costly, not everyone has a decent job nor minerals are infinite and have no ecological impact
I deliberately avoid all banking apps even though i didn't root my phone, but i have to use Google Pay a lot. So... That's the only reason this phone I'm typing on isn't rooted.
https://www.ftc.gov/news-events/news/press-releases/2024/12/...
Sometimes when party tickets come online I have to be really quick to buy them for early bird price.
Is it really? £150 on backmarket for a phone which will last 10 years doesn't feel expensive.
Makes sense to me to run any banking on a secure device anyway.
Ps no it's not rooted but it won't pass full play integrity so it will usually be treated as such.
Also, a properly configured root is not a weakness just like having a computer where you don't log in as admin unless you really need to can be just fine.
If I could get away with carrying a tiny device again instead of lugging around a brick I would, but the world has made it as inconvenient as possible not to.
A BlackBerry from 15 years ago weighed just over 100g and did 80% of what your modern-day pocket computer can.
I remember BlackBerry OS 4.x (?) had a built-in password manager app and this was in the mid-2000s. By comparison this was added to iOS 18 in 2024.
What it wasn't good at was things like games and toxic consumer rich media bullshit. The industry saw dollar signs with iOS and Android and never wrote apps for the ecosystem.
Remember the days when Instagram was iOS-only?
But here we are, resigned to typing on glass for the rest of our lives because some hippie burnout thought it was a good idea.
Then they might move somewhere else with different banks and different hardware requirements, they will carry 5 phones.
If they stopped, I think I would seriously consider swapping banks and whatever else instead of using a different OS.
Cheers, maybe by 2027 unattested devices won't be allowed on the internet. It's not a solution. The problem didn't exist a few years ago, the idea that it will not continue to its inevitable conclusion within a few years without real solutions is laughable.
Wait until Graphene is classified as a hacking tool and Estonia convinces the EU to fine a million Euros a day any company providing services to host its website. Wait until, "in the spirit of reconciliation," the US goes along with it, too.
Wait until unattested desktops aren't allowed on the internet.
On the other hand, France has been undermining privacy for a few years now. They supported Chat Control, have attacked GrapheneOS, etc.
Then you choose the flagship device you're going to use 99% of the time on the basis of how easily you can unlock the bootloader/root.
I run a proxmox server on my home Lan with all the services and storage I want, including a wireguard server. My Android phone can then connect to my home LAN services from anywhere in the world (my ISP provides static public IP addresses).
My Android device is then a simple terminal to all my "stuff". It can be locked down as much as they want it to be, as long as it can run WireGuard. I have no use for a rooted phone. In fact I want it to be as hardened as possible in case of theft.
Most of my banking apps work fine on GrapheneOS, but I've adopted this because I'm confident they'll eventually break. And access to Apple Pay is nice.
Carrying two phones is annoying, but, agency over my main computing device is worth the price.
Not that it excuses the withdrawal of user agency. But I've never used a banking app on my phone before. Anything important I still like to do on a desktop.
Though how much longer that's safe, who knows. Apple's model of requiring their permission to run code on your own device will probably spread to everything given enough time.
Here in Europe, good luck using any form of online payment without one due to 2FA requirements.
I guess you could take your laptop out at the restaurant and in the taxi to pay. It seems a little strange. You might better just use a browser on the smartphone instead of the mobile app.
A lot of banks require using their banking app to get a 2FA token to log-in on a desktop web browser.
The Coming War on General Purpose Computation
https://boingboing.net/2011/12/27/the-coming-war-on-general-...
That has been the model since day one, since you are using spectrum that, because the end users are not licensed, requires it. Radios in 100% of commercially available phones are locked to prevent user tampering.
You don't get root on your debit card either, despite it running a computer.
Why, then, can users be root on PCs that have wifi cards, SDRs or cellular radios?
SDRs? Because they are not certified transmitters. They are test RF gear, or a component of a transmitter, not an end-user product.
Cellular radios in a PC? You don't get root on those. Same situation as they are in a cell phone: They are licensed-band transmitters, and they are required to be tamper proof to protect the licensee.
The original post said:
> Locking down the bootloader and enforcing TEE signatures does stop malware. But it also kills user agency. We are moving to a model where the user is considered the adversary on their own hardware. The genius of the modders in that XDA thread is undeniable, but they are fighting a war against the fundamental architecture of modern trust and the architecture is winning.
So, as I read it, Fiveplus is saying that we are moving to an architecture where the user is an adversary on the computer (the phone) as a whole. While licenses may require that specific components are out of bounds, the new thing is that the whole platform is denying the user the ability to do what they want with the parts that are not explicitly off-limits.
IIRC, a Blu-Ray drive is required to store data about revoked keys and to stop playing discs if its own key is revoked. Presumably the BR license also states that the user can't be allowed to wipe this revocation list and start playing Blu-Rays again. But BR drives can still be fitted in computers where the user has root access, just like PC cellular radios.
Phones are made to be default-deny instead of default-allow, and I think that makes it different from "enclosed modules you don't have control of".
As of November 2023, zero applications are licensed and capable of playing UHD Blu-Ray disks [0], and PC manufacturers are just not including the hardware necessary to do so.
0: https://www.cyberlink.com/support-center/faq/content?id=2834...
Even as a licensed ham it's getting increasingly difficult to even get hardware that allows utilization of frequencies I'm duly licensed to transmit on in the 2.4 GHz band. Short of building and designing your own transmitters it's become impossible to repurpose hardware like it was before. Our club has aging M2 Rockets from Unifi that were modified for this use that are now decaying and dying. It's unfortunate too because once these stop working that's it. A few club members have been championing GLiNET but same problems. They are relying on older models which weren't as locked down and already show signs of suffering the same fate as the Rockets.
I stopped using banking apps on my phones a few years ago - they got more and more annoying, and I don't buy into the "the device is secure and should be used as a trust token". So I'm now back to banking only on my computer, with a hardware token for TAN generation.
Here in the US, I still get checks frequently enough that it's nice to have.
I only used them twice in my life, last one was in 2012 and I had to get a supervisor at the bank to find the procedure to get a checkbook at the time.
I do own a home but find that almost everything can be paid online now. I write just a few paper checks per year. Even my taxes I pay on the state or IRS website (with ECH, so effectively a check but without the paper).
I only have to do this rarely, and it’s always because the recipient wants to charge a “convenience fee” for having me pay with ACH or debit card or credit card. (The seller is assuming people would rather pay an extra $3 to $5 to not have to write a check or mail anything).
And I have no idea why, but no bank offers photoTAN devices in my country. They seem like an interesting concept, even though I imagine the underlying hardware isn't far from that of a phone, in the end.
Previously there were also so called "flicker TAN" approaches: https://de.wikipedia.org/wiki/Transaktionsnummer#chipTAN_com...
Sparkassen: https://www.sparkassen-shop.de/home/shop/tan-generatoren,375...
I only know of a single bank using this.
If it's not Crédit Mutuel then you now know of a second bank using this method.
The old, standard RSA number generator token key ring device is not permitted in Europe for authorizing bank actions ?
The requirement is called "dynamic linking" (the 2FA code must be tied to the specific transaction) and the relevant regulation is PSD2.
They don't really like you using that and keep annoying you to stop doing that, but I don't think they'll fully get rid of that - those are filling some accessibility niches as well.
I'm essentially along for the ride because the masses will gobble it up.
I grew up in a world where personal computers weren't strange things (the 1980s). I remember reading Levy's "Hackers" in my teens and not comprehending how people could think personal computers were such a big deal. The talk about "technical priesthoods" and mainframes, the inaccessibility of computers to "normal people", etc, didn't mean anything to me.
Now that I'm living through the twilight of the personal computer I understand.
Money is speech, and speech builds political power. Industry lobbies have vastly more money than the minuscule number of people to whom this matters.
On top of that, the market doesn't want general purpose computers. The market wants TikTok terminals and selfie cams. The market wants "content consumption", "AI slop", and "influencers".
If there's no market for what I want it doesn't matter if it's legislated out of existence or not. Nobody will build it if nobody will buy it.
Then there's the apologists for big tech who cry "But they're not computers, they're phones!" when the fact is brought up that we're all carrying general purpose supercomputers bristling with sensors and radios in our pockets but we're not allowed to own them or use them for what we want. (Cue sob stories about clearing malware from oldsters' computers in 3... 2... 1...)
Technologists (who I'd argue should want general purpose computing in the hands of the masses) can't make any money re-architecting the OS and application metaphors and paradigms that give rise to the malware-laden cesspools of end users PCs so they just direct their efforts to working at big tech building the walled-garden prisons that we're all going to be forced into.
It's hard not to feel like I have to accept this fate.
all they really need to do is to make the Internet inaccessible from any device except the castrated thin clients that our computers are doomed to be replaced with. and that can be done trivially.
unrelated to phones a lot of (more professional) malware has moved to not persist itself in root space (or at all) as to not leaf traces (instead it will just rely on being able to regain root access as needed every time you reboot with all the juicy parts being in memory only (as in how often do you even roboot your phone))
I think (but am not fully sure) this also applies to phone malware.
I.e. no it doesn't work.
Not unless you
- ban usage of all old phone (which don't get security updates)
- ban usage of all cheap phones/phones with non reliable vendors
- have CHERY like protections in all phones and in general somehow magically have no reliable root privilege escalations anymore
Oh and advanced toolkits sometimes skip the root level persistence and directly go into firmware parts of all kinds.
Furthermore proper 2FA is what is supposed to make online banking secure, not make pretend 2FA where both factors are on the same device (your phone).
And even without proper 2FA, it is fully sufficient to e.g. classify rooted phones as higher risk and limit how much money can be transmitted/handled with it (the limit should ignoring ongoing long term automated repeated transactions, like rent).
There really is no reason to ban it.
I have no idea about the kind of malware you're talking about.
The only solution is to force some semblance of user agency on those models, such that the vendor isn’t imposing from above.
Outdated but signed ROM with tons of unfixed CVEs will be still considered totally fine.
Latets Lineage OS or Graphene OS will be rejected.
This is lazy control.
Doesn't stop state approved malware in all its forms.
> The irrefutable part here is that the security model works.
Yes! And that business model should be allowed.
This leads me to worry the notion of "user agency" may be misplaced, meaning, aimed at the wrong level of the stack. It would seem both open (general compute ethos) and secure devices (appliance ethos) have a right to be in the market. So…
### Perhaps user agency should be at the experience level. ###
We couldn't plug Sega Genesis cartridges into Nintendo 64. We understand this about consoles. If we remap mobile devices into consoles, it seems less obvious their internals should be opened and tinkered with by end users.
User agency seems more at the level of picking a console family, and it's often for the whole brand aura including both the console itself and safeness-to-permissiveness dial by which the brand curates its the cartridges (spectrum from Nintendo to Apple to Sony to Microsoft and Steam). A free market for mobile devices or desktops would likely sort out a similar spectrum of just-works to fidget-able. If you choose the Nintendo 64, you wouldn't expect to run arbitrary software on it as you would expect on Dell.
We hackers are capable of figuring out how to make Nintendo 64 software; our neighbor does not need or want those affordances, they want just works, no headaches. This idea that the user must be able to open their digital watch or toaster oven and change how it is wired glosses what users actually choose: the conveniently toasted meal.
At the same time, business models around the curation and appliancification of digital tools, blurring the lines from hardware through solid state through firmware to software into a single product users can choose, must be defended.
If I want to dev for a secure product, I similarly must be OK opting into the supply chain security model (with Apple, registering as a dev in order to exchange cert material and bypass consumer paths to loading software I'm making for the platform) that allows that product to be secure, and opted into by users with money to buy my app, that caused me to want to develop for it in the first place.
Users must have a right to buy an appliance that isn't fiddle-able. Not mandated to, as this article sounds, but allowed to as the EU is trying to deny. Such products have a right to exist, and such business models have a right to exist.
And then, user agency remains as simple as use dollars to buy a product offered through a biz model that matches the user's goals, rather than regulate to disable business offerings offerings/products that don't, and developer agency is to pour energy into the platform that aligns with one's ethos.
If more money is to be made on a platform with a different ethos, perhaps it's worth reflection rather than rants.
This totally beats the purpose of owning or using tech. Might as well go off grid and live a non-tech life.
Big tech wants to colonize our hardware completely because data centers alone ain't cutting it.
1$ Trillion has to be paid back to the investors plus interests. They screwed up with AI and we have to pay for it. Or maybe they didn't screw up because big money always gets bailed out by the plebs.
I think we’ve been there at least since the first iPhone, and it’s now entirely normalized for the average user.
The Vietnam government has banned phones under their user's control from using any banking app.
To give a specific example, suppose a banking app wants to require location services in order to try to login. Some users can bypass or spoof this, (in fact that's what the thread is about entirely, and for that they root the phones.
Not all users who root the phones violate ToS, but it's a majority, or even a possibility, so they choose to disallow such usage.
Pretty sensible stuff to me.
where exactly do you work with this agenda and reasoning? thats insane? banks have been more or less made mandatory by the regimes around the world, and now these things. How can anyone possibly consider it sensible?
I'm not against having a separate secure phone to use with banking apps, but that phone must be designed for security, not for Google's ad driven business model..
I wish we didn't have to choose between Google and Apple, especially here in Europe where we can be sactioned by the US for doing our job..
https://privsec.dev/posts/android/banking-applications-compa...
2. Vietnam has been in the process of rolling out national biometric identification for years now as part of the VNeID [0] project, and unifying that with banking and mobile phone identification is an important part of that such as with the recent FPT Telecom announcement [1]. The aim is to turn VNeID into a super-app by 2030 [2], and from what I've seen in rural areas of the Central Highlands, it's on track.
[0] - https://vneid.gov.vn/
[1] - https://tuoitre.vn/vneid-mo-rong-dich-vu-so-dang-ky-internet...
[2] - https://tuoitre.vn/thieu-tuong-nguyen-ngoc-cuong-nang-cap-vn...
The bank's app can then ask the OS to sign documents using the TPM's secret keys, and the OS forwards such requests to the TPM. The TPM refuses such requests from modified OS but obliges requests from an unmodified OS. The bank's servers refuse to accept documents not signed by the TPM.
Root can't pretend to be a TPM and make up some secret keys to sign documents with because the TPM's signature is itself signed by Google, so the bank can tell the difference between root's signature and a treacherous signature.
I also prefer to own my device and be root on it, while installing all the "pretend I'm non-rooted" functionality on it, I did think "this is basically installing a rootkit to tell the OS 'yes, I'm clean!'.". Then my bank (fuck them very much) decided to add a check for a locked bootloader and refused to work without it. I suppose maybe there's a way for the "rootkit" to lie and say "Yes the bootloader is locked!"?
I didn't read all the comments, but it seems to have been lost that it's a fight between freedom (allowing people to "own" their devices) and protecting the general public from harm (being scammed and losing all their money). We also have to give up some freedoms, eg. we are forced to wear helmets or seatbelts as participants of traffic, to ensure a better protection.
This has always struck me as a matter of checkbox compliance rather than a commonly-exploited attack vector, though I'll grant that's partially because few people actually use such devices.
This is pretty clearly a case of "oh there's an option here that says 'allow on rooted phones', do we want to allow that?" "No that sounds scary and risky! Of course not. We must not allow it."
The option is there, and nobody is going to try to sell not ticking it.
A significant amount of fraud comes from scammers convincing victims to installed malicious apps. They fake being a customer service provider.
Banks don't want their customer's to lose their money and they don't have the tools to protect them from themselves. For all the privacy reasons, app stores don't even banks enough tools to identify and block this fraud.
I’ve also had other banks do the same. They provided me with a debit card that supports international transactions but they did not allow logging in from most Asian countries. So I would log in from Asia, be blocked, turn on my VPN and log in from the U.S. to check the balance on my card.
Separately, I couldn't even log onto their system this week from my desktop browser because of some bug. (Accessing from the US). It didn't recognize my username or password, let me change my password, then said it didn't recognize the new password.
When finding help on how to do this, people were saying it's useless cause they can proxy/VPN anyway, but obviously that has some cost to them because they weren't doing that. So seeing how I had no legitimate traffic from there, it was an easy choice and cut out like 99% of abuse.
The Vietnamese government has reported a rise in account takeovers and other banking thefts [2]. SIM-swapping has been a tactic used. Adding difficulty for fraudsters to trick unsophisticated banking customers is a valid security layer.
1. https://vietnamnet.vn/en/biometric-deadline-nears-millions-o...
2. https://evrimagaci.org/gpt/vietnam-faces-surge-in-sophistica... (expands upon https://vneconomy-vn/techconnect/mobile-banking-phat-trien-manh-tai-viet-nam.htm)
[0] - https://vneid.gov.vn/
[1] - https://tuoitre.vn/thieu-tuong-nguyen-ngoc-cuong-nang-cap-vn...
You fight SIM-swapping by outlawing the moronic practice of using SMS for anything security sensitive. Not by blocking user modified OSes.
So that would be a dumb thing for a Vietnamese bank to use as a recovery method.
1. Incompetence. The same reason why many banks al around the world do this without regulations. Some snake oil salesman sold them a security theater SDK or library that blocks user installed or modified OSes.
2. Government control and surveillance. Vietnam is authoritarian. It only makes sense for them to participate in the global war against general purpose computing to gain complete control over their citizens' devices allowing them to restrict software, displayed content and communication to require government approval and enable total surveillance of all activity without any way to bypass this. Instead of outlawing user controlled general purpose computing directly they do it through the backdoor of pretending that it is for people's own safety.
Anyway it's not like they're the UK and have age ID's for their internet lol
> malicious actors just compromise the firmware instead
surprised pikachu face
Not deep into rooting scene but seems plausible to me that this has some merit if you squint at it from the right angle
Trusted agents are useful. And I'm using legal meanings, not technical meanings here - so a "trusted agent" is someone or something that is legally acting on your behalf, to perform actions as though you were performing them.
The whole fucking promise of "general purpose computing" is that citizens should be able to delegate repetitive and tedious tasks to a computer. And they should have the full freedom to pick both which tasks are delegated, as well as which agent (program) is performing them.
Instead - what we're seeing is that companies are closing off as many avenues of automation for the average citizen as possible, under the guise of security.
The problem is that selecting a neutral (trusted!) agent is really, REALLY important, and companies are absolutely not neutral. They don't want the best results for "average Joe customer", they want the best results for themselves: the company.
They will make decisions that are contrary to your best interests all the time. They have exactly zero fiduciary duty to you, and boy do they know it.
In a decent world - in a decent CAPITALIST SOCIETY (which we can already debate the decency of in the first place) you allow space in the market for modification. Ex - don't like your desk? Change it. Don't like your car radio? Change it. Don't like that tool handle? Change it. Pick a different one, even one from a totally different company. Replace it.
This allows new ideas, new growth, and prevents stagnation.
In the digital world... there are a few companies that are trying as hard as possible to prevent you from being able to change anything.
---
Want a new browser? Fuck you.
Want a different UI for your banking needs? Fuck you.
Want to watch something without the ads? Fuck you.
Want to watch something with the ads, but in a less miserable ui? Fuck you too.
Want to automate something? Fuck you.
Want to export your data? Fuck you.
Want to sell software without us taking our rent money? Fuck you.
Want to shop in a different store? Fuck you.
Can't be letting our users make decisions that might cost us money.
---
So we're seeing an absolutely insane number of "digital locks" being employed not to protect users. No - instead they're getting deployed to protect revenue at the expense of users.
The only possible outcome is that service quality degrades to the point where you literally are better off without. Because that's what happens to incentives when you let companies operate in this manner.
If the consumer has no choice - the market has no power, and what little value there is in capitalism goes right into the trash bin.
So sure - if you squint, this maybe prevents someone from making a bad decision on which agent they trust.
But the problem is that now they HAVE to trust an agent they know is going to make bad decisions for them. Hope you like the biggest ad company in the world owning you digitally... Serfdom here we come.
...but I don't think that's the lens legislators look through here. I think it's more like "Last week and upset constituent lost all their savings". This politician cares more about protecting gullible constituent than a hypothetical stallman-esque freedom argument.
Not saying I agree, but rather that I can see why a politician might land on that conclusion
Ie: the much larger percent of users affected by this news would already be more technically savvy and one would assume be less susceptible to known scams.
To your parent point though, sideloading apps per se OTOH is something most Android installs can do without rooting or a replacement OS. Google is already rolling out developer verification requirements for sideloaded apps on GMS Android installs (most devices) to mitigate impact of malicious apps, so there is already action being taken for regular users.
One could imagine other reasons Vietnam may want to dissuade more tech savvy users from running AOSP-based installs (such as GrapheneOS, which is known to be robust against Cellebrite) and using banking is a decent place to start.
If you mandated that they have to support Yubikey or whatever on open platforms I'd take that as a decent alternative. But just "no you must use a device controlled by somebody else" is not acceptable.
Now, we're locking people out of society for having the audacity of wanting to decide what gets run and not run on their computers?
Piracy isn’t merely a virtue, but a moral imperative, an obligation to uphold civic freedom.
It is immoral not to pirate. It is everyone’s duty to do their part in normalizing and encouraging piracy.
The problem here isn't the money, it's the lack of privacy and control.
The best analog I can think of to piracy in this situation would be rooting the phone/installing GrapheneOS. And, yeah, that's definitely something people should do if they want that control, but I really hope people don't put it in the same category as piracy...
See also this article from Cory Doctorow:
How many companies even produce these controllers?
But that weak ass crime, that we like to call pirating in order to appear cool, No, that is not theft at all.
App sandboxing and system file integrity is one of the most beneficial security features of modern computing, and the vast majority of people have no desire to turn it off. You can buy rootable phones. People overwhelmingly choose iPhones instead.
Even if Apple sold the SRD at scale, nobody would buy the weird insecure hacker iPhone except us and maybe kids who realllly want Fortnite.
For the masses, lack of system-level access is a benefit because they won't be able to ruin their device. For hackers and hobbyists, lack of system-level access is a hindrance because they won't be able to control their device.
All other things being equal, we should try to protect people. But we shouldn't force everyone to make the choices that are best for the people with the least comprehension of what they're doing.
Of the few people using rooted phones to begin with, there's even fewer that don't know what they're doing.
Much more likely is this is a decision to get in line with the well documented and rapidly spreading surveillance laws of the past few years.
> But we shouldn't force everyone to make the choices that are best for the people with the least comprehension of what they're doing.
You are acting like it's easy to accidentally root your phone
We also limit investing in certain types of investments to so-called “accredited investors” which is just legal jargon for “millionaires”.
I don’t think the point you are trying to make about letting people own-goal is as strong as you think it is. (I would have gone with “roulette is legal”, which is a better one that the investment one, as the accredited investor rule is in all 50 states.)
If you are interested in the public good, I think it is pretty clear that we should ban roulette overnight since it has a negative expected value for everyone but the casino. On the other hand (still presuming you're interested in the public good), I think you have to consider very carefully whether it's good or bad to lock people out of investments or to restrict people's access to health care.
Why can "normal people" be trusted with a car then? Or firearms? Or kitchen knives?
Tylenol is another example. Building materials is a third (building and fire codes are a relatively recent invention). Hell, even penicillin is by prescription only.
Letting the circumstance happen where median people can easily cause externalities through ignorance or carelessness is how we incinerated the planet and destroyed the biosphere as we know it with fossil fuel emissions, because it’s nbd (still even now in 2026, when we know about runaway polar greenhouse curves) to get in your ICE car and drive to the corner store.
When normal people had GP computers, we got botnets millions strong and DDoS in the Tbit/sec range and keyloggers on every hotel lobby computer hooked up to the boarding pass printer. Median people are way safer on the internet now than before.
If you mean Indonesia (the county closest to 3.5% of the human population) or the US (the nearest above 3.5% at 4.1%+) then you are high by an order of magnitude. Two jumbo jets are around 1000 people. US car deaths are around 100 a day and Indonesia is a little lower.
If you mean Pakistan (the next country after Indonesia at 2.9%) you are high by close to two orders of magnitude. They have around 15 deaths a day.
Much in the same way we try to limit physical addiction, which hypothetically only affects the person taking the substance, and gambling (though we're moving backwards on sports betting).
Some hypothetical social ills: 1 If it's a good source of money, it becomes more ubiquitous. This leads to entire illegal markets, which will typically lead to additional crimes, up to and including human trafficking, slavery, organ harvesting, and murder https://en.wikipedia.org/wiki/Scam_center.
2. The victims of scams will often feed shared or even stolen assets into the scam, desperately relying on an eventual return that will never come. This mirrors one of the better known social ills of gambling and addiction.
3. Even for people that never fall victim, defending against scams is tiring, irritating, and damages social fabric. An easy example is how spam cuts down on the utility of phone calls. In general, to be safe you have to be almost irrationally suspicious of anyone being surprisingly friendly, which makes non in-person connections -one of the greatest benefits of the internet - much harder and more dangerous to forge.
What do you think, is that enough reasons?
4. These kinds of "social ills" hypothetically affecting only individuals, actually spill over to affect their families, and, at scale, communities.
That being said, in most cases it still doesn't justify this level of drastic intervention. Otherwise, cigarettes and alcohol and even Lotto would've been banned out of existence by fiat.
You can have sandboxing and system integrity while still giving the user overrides. But hey this is not Google and Apple's business model because it makes you less dependent on them. And it interferes with their sweet 30% rent-seeking app stores.
Mobile security works this way not because it's best for us but because it's best for making them money.
> You can buy rootable phones.
Eh yeah but the problem is of course being locked out of apps if you actually root it.
I don't want Google or Apple to decide what I can do with my phone. Or the government like in this case. This also opens the door for evil spyware like chatcontrol in europe. Even today they are trying to enforce a backdoor into whatsapp to block "harmful content" which is of course impossible without breaking or circumventing the E2E on-device.
> People overwhelmingly choose iPhones instead.
Maybe in America, not here in Spain. I guess not in Vietnam either.
I think this is wishful thinking, and the most experienced organizations in the world in this field agree with me. You can’t square this circle.
We can pretend that these two things can coexist, but they cannot. Where there are overrides, there are youtube tutorials on how to disable the overrides to install malicious botnet vpn surveillance proxy apps to get free robux. (to borrow a turn of phrase from @ptacek iirc)
If you give users an escape hatch, they will get malware in ring 0 and Apple Pay will stop being a thing because people’s cards will start getting remotely skimmed at scale. (Or Amazon will give you 1.5% off all purchases to install a rootkit that uploads your complete realtime cc nfc purchase boop history and email receipts and location track so they can figure out which businesses to clone/dump on next.)
If you say “…but not the SEP” then you’re just admitting that you need a part of the phone the user does not and cannot control. Most users care about the privacy of their nudes and sexts so they’d rather it be the whole damn phone.
Did we forget that even the not-full-scale escape hatch that was enterprise app certs was abused by Meta (then Facebook) to install surveillance VPN backdoors on customer phones at scale? Apple didn’t even know bc they were sideloading them via enterprise certs and when they found out they revoked them across the board, but by then thousands of people had had 100% of their phone’s network traffic surveilled by an ad company without consent.
Got it.
And remember the consequences when Apple starts scanning all your photos and sends a SWAT team to arrest a father who took a picture of his son's rash and sent it to a doctor, because surely he was engaging in child abuse.
I rather have Meta steal info of the 100mln idiots that install their root kits on their devices than have Apple and Google do the same for Billions (with a B) to protect from the former.
How? What kind of overrides? You mean that Safetynet could still report attestations?
I have no idea how it works, but doesn't it require a chain of trust, starting from a known boot image, then every process that can write to arbitrary memory needs to be a known image? (And even that might not be enough if there are ways to dynamically exploit them.)
In those systems, it won't boot without a good signature, so the user is protected against attacks that break the user's chosen chain of trust.
Remote attestation of consumer devices, e.g. Safetynet is evil.
I don't believe in remote attestation anyway. It didn't even say the service is secure. It just proves it's as released by Google. But security doesn't have to rely on a big brother checking things for you. You can have security without it.
There was never going to be anything preventing non-technical folks from buying iPhones. They can and should have what they like.
Why should there be a law that forces that same compromise onto anyone who can only afford a single device and needs to use it to access their bank?
If there is a series of buttons you can press to circumvent the anti-scam measures, then the scammers simply walk you through pressing those buttons. If you cover them in giant warning labels the scammers simply add explanations into their patter. The buttons must physically not exist, for gullible people to not get scammed out of money.
The next response will be 'well maybe we shouldn't accommodate them'. They vote, and there's more of them than you.
The average user simply does not have the skill to determine real from fake and any heuristics to do so will be defeated by the scammers. You have to be able to understand what could be done with access, not what's "intended" with the access.
No, only when you don't do this and nothing else to improve security. You're presenting a false dichotomy.
> If there is a series of buttons you can press to circumvent the anti-scam measures, then the scammers simply walk you through pressing those buttons.
If the scammers can walk somebody through doing all that, why would they stop at just asking them to send money over to them "to safekeep it because of a compromised account" or whatever the social engineering scheme of the week is?
We shouldn't be protecting someone that gullible at the expense of everyone else who is smart enough to actually read whats on the screen and not fall for such simple scams.
Not that long ago most of this forum was very much against giving up freedoms in favor of catering to the lowest common denominator. What happened?
People need to take responsibility for their own actions and educate themselves, not rely on a lack of freedom to protect them.
My uncle, an engineer, was scammed out of his life savings last year. He was a smart guy, he just got older.
I don't care. Society doesn't exist to keep people safe from their own bad decisions.
Regardless, it isn’t a law that you have to buy an iPhone.
Bullshit. Big tech's war on general purpose computing hasn't stopped scam. It's a pretext for rent seeking and control and you know it. It's the reason we don't have a popular ecosystem of FOSS alternatives on mobile. It's the reason we can't run virtual machines on tablets when the hardware very much can.
If combating scam is a priority of big tech, I know where to start. Get rid of ads! That would actually be enormously effective as it gets rid of the primary entry point of scams.
> If there is a series of buttons you can press to circumvent the anti-scam measures
So the best you can come up with is an imaginary button on phones that can magically circumvent checks that should be implemented server-side? Have you any idea how software works?
Further, the people promulgating this sort of solution know this. The evil is that they are wittingly using a problem as the excuse and the cover to get something else they want which they would otherwise never get and have no right to.
For everyone who is doing this knowingly, there are countless other sincere but unwitting tools haplessly just buying the line sold to them. So you might be able to say you are not evil for supporting this kind of policy, but all that means is that you are either a witting or unwitting tool of the evil policy.
"Rapes happen behind closed doors, therefore we have to remove all doors. No one denies that rape happens and that it's a bad thing. And it's irrerfutable that without doors that close, no one would be able to get away with a rape. And so, the only grown-up thing to do is agree to give up doors that close. It's not an evil at all."
This is kind of a shitty compromise, the second you leave a tiny crack open in the security, maybe through root access, maybe some better sideloading, somehow people WILL be tricked into installing malware, and it baffles me...
I've seen it happen multiple times with my older (and younger, though less often) relatives and acquaintances, I'm really not sure how like a solid 5 dialogs that scream at them with sayings like "do not do this", "this is dangerous", "if someone is telling you to do this they're a scammer", and that somehow raises zero alarms, however if you tell them to consider the possibility that they're downloading a virus, or that the nice IT man on the phone is probably not that trustworthy, they will simply not believe you.
That's why I kind of get the paranoia, though most of it is just that and I really believe that software freedom is a whole lot more important.
The real irony here is the use of free software to tear down everything the free software movement stood for.
I do not know whether Vietnam has any pretence of digital sovereignty, but many countries that do are doing this like this to actively move away from it.
Kinda weird, if you think about it. But that seems to be the way it's heading.
Anything remotely more advanced than that, please let me use my computer and an app or website with, you know, an interface designed for more advanced operations.
Trying to do anything on a smartphone/touchscreen only device is nothing but an effort in pure frustration for me.
Of course in Canada we have a banking oligopoly that is effectively there just to rob people, but ironically any of the “challenger” startup banks are 100% app based afaik
I did install app from CIBC for one single and the only purpose - deposit cheques sent to me by clients to my business account without having to go to ATM or the bank teller.
> Of course in Canada we have a banking oligopoly that is effectively there just to rob people
No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation.
Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days... The only thing missing is a secure input and output channel, like a small built-in display and a button or biometric input.
In any case, I somewhat empathize with banks in that they want to ensure that my transaction confirmation device is not compromised, but getting to dictate what software does and doesn't run on my own hardware outside of maybe a narrow sandbox needed to do that is a no-go.
It's not money-preserving though. You need an extra device, and an extra phone number. The separate phone number is another privacy-preserving feature though.
A cheap Android phone is pretty much the opposite of a Yubikey, in terms of trusted computing base and attack surface.
That is one of the reasons the crypto market is behaving like some radical innovation instead of just a group of bozos speedrunning financial history. For the first time since the invention of capital we have an asset class where it doesn't take the cooperation of a group of armed thugs to guarantee the integrity of the system.
My favorite, basic example is this: I'd like to create my own basic widget showing me my account balance on my phone's home screen. Doesn't have to be real-time, but accurate to +/- few minutes to what the bank app would say when I opened it. It has to be completely non-interactive - no me clicking to confirm, no reauthorizing every query or every couple hours. Just a simple piece of text, showing one number.
As far as I know it, there's no way of making it happen without breaking sandboxing or otherwise hacking the app and/or API endpoints in a way that's likely to break, and likely to get you in trouble with the bank.
It should not be that way. This is a basic piece of information I'm entitled to - one that I can get, but the banks decided I need to do it interactively, which severely limits the utility.
This is my litmus test. Until that can be done easily, I see the other side (banks, in cooperation with platform vendors) overreaching and controlling more than they should.
The point of the exercise isn't to just see the number occasionally; I can (begrudgingly) do that from the app. The difference here is that having the number means I can use it downstream. Instead of a widget on the phone screen, I could have it shown on a LED panel in my home office or kitchen[0], or Home Assistant dashboard. Or I could have a cron job automatically feeding it to my budgeting spreadsheet every 6 hours. Or I could have an LLM[1] remind me I've spent too much this week, or automatically order a pizza on Saturday evening but only if I'm not below a certain threshold. Or...
Endless realistic, highly individual applications, of a single basic number. The whole point of general-purpose computing empowering individuals. If only I could get that single number out.
--
[0] - Why would I want that is besides the point.
[1] - E.g. via Home Assistant.
Maybe in US. In Vietnam, $300 is the average monthly salary, and the minimum wage is around $150. Probably the majority of people don't have a primary phone worth more than $300.
Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work.
I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.
Otherwise, they just get to be OK with offering me a website or letting me transact with them on my own device that's under my own control without stipulations like requiring attestation, or prohibiting root.
The point is, governments nor banks or other private entities, should be getting to dictate what can and cannot be done on someone's computing device.
A country that is a dictatorship - I can understand why their slaves have to go through this. I fail to see why a true democracy would do this though. There is zero need to be required to have a smartphone; all those transactions work perfectly fine on a desktop computer system too, under Linux. People then may have a second device at home, some card reader and/or a thing such as Yubiko or something like that. IMO not even this should be required, but to mandate an app that would not be permissive under Linux - that is true dictatorship. I am surprised the government of Vietnam went that way.
(From the kernel-level anti-cheat discussion the other day)
Just "a phone" with a bad update policy is $100.
I really hope we can convince enough people to care about general computing.
No need for the scare quotes. Forcefully removing people's agency over themselves is pretty much the definition of evil. We do not hurt criminals as punishment anymore, in the civilized age, but we still lock them up.
Now, of course we should not equate physical prisons and digital prisons in any other way, but we should absolutely call both forms of imprisonment evil, plain and simple.
You can protect against that by requiring the app to have a valid signature. You cannot guarantee that the signature is valid unless you can guarantee that the kernel has not been modified. You cannot guarantee that the kernel has not been modified if the phone has been rooted.
For what it's worth, my banking app for my Canadian bank (and the app which does second-factor authentication for web transactions when doing web-based online banking) will not run on a rooted phone. For good reason, I think.
My bank used to use SMS for second-factor authentication, but no longer does so. For good reason. When I do online banking from my desktop, I still have to use the second-factor authentication login on my phone. Or sim-less tablet, interestingly. Whatever the mechanism, is, it is not SMS based.
That's why you can't have root access to the modem even though you technically own it.
In fact this is what led me to unlocking the bootloader, swapping the OS and rooting my phone. The infuriating situation where if you setup so called "corporate owner" (or mdm) during the first login you can add your own certificates, but if you don't... Basically the "corporate owner" of your phone is Google.
Yes, literally, you do not own it.
Also it is worth noting certain countries where "rooting/bootloader unlocking is illegal" - namely China and the horrible stupidity of people claiming EU Gdpr prevents manufacturers from offering simple bootloader unlocks for their phones.
We absolutely need to vote with our walkers. I bought a Samsung before and a Xiaomi recently only because both allow relatively simple unlock (ok the Xiaomi requires you to wait to press "request unlock" exactly at midnight Beijing time", and it only works for non-Chinese phones, but still unlocks fine.
It is better for the vast majority of people that they don't have root access to their PC or phone or tablet because they are unequipped to securely manage that AND it has basically zero upside for them. They can't manage updates. They install random programs from the Internet to get smiley faces in Outlook.
This may offend your sensibilities. Sorry. But you're living in a fantasy land if you still hold onto this narrative, particularly without explaining to ordinary people how this will practically benefit them beyond theoretical platitudes about "freedom".
Yes, absolutely, most people would be better off not having that control and most of those people are also fine with not having it.
But everyone, for better or worse, has the right to demand that control if they want it.
Through the 00s, Apple practically built their reputation on being "virus-free" which really just meant they locked out the user from being able to do anything too extreme.
Could we have the same level of security - or very close to it - from requiring a secure enclave like a vm running on the device for banking apps with hardware passthrough, or would there be no way for that vm to verify it has actual hardware passthrough and that it's not being tampered with?
That way you would just get the entire vm with the app from the Play Store or Apple, and nobody needs to worry about root?
That's the reason I mostly use online banking on the web, not on a device.
If it ever comes to that in my country I can also use my previous, unrooted backup phone to host these apps and keep it at home.
I'm not at all thrilled of the idea of carrying your credentials to your bank account on your phone, accessible via a 4-digit PIN out there in the world in the first place. For some reason, banks think it's great.
It's not just root that they block.
It's ridiculous.
On one hand, people that jump through the crazy hoops phone manufacthrers put up to get root are either technically-proficient or willing to become so and are, usually, responsible enough to keep their devices locked down and secure.
On the other hand, banks are subjected to literally all of the regulations, and breaking any of them usually incurs unbelieveable fines. Given that phones are the default computing device for most people these days and how (relatively) easily secrets can be extracted from rooted devices, blanket-banning them makes a lot of sense.
Nonetheless, modern Android is just as locked down as modern iOS, with a few exceptions (like adb access) and without the awesome hardware and software optimizations for that hardware that make video recording fast and web browsing even faster. Between this and nobody having a real answer to Apple Watch, I'll be an iOS stan for the foreseeable future.
What is it? I can access their websites on a PC running as root or Administrator. What is the problem with rooted Android phones?
Apple is already a walled garden, granting you only access to your hardware and they see fit. Google desperately wants to follow suit by enforcing developer registration (which is just the first step). And now this. This is will happen in the EU and US as well.
And always in the name of security, safety, or "will nobody think of the children?!"
My hardware, my choice, period.
You can choose to not use the app.
The bank has a choice on how customers interact with it.
The government, regulating banks, and often acting as insurance for lost money, has a choice on setting required security standards.
Balancing all these is difficult.
I am probably missing something obvious(some sort of tpm key attestation) but it feels like it would be impossible task. I mean, theoretically higher layers can check that lower layers have the correct signed checksums, but they need to use the lower layer to do it and the lower layer could just lie to them. (if isSystemFile(f_name) then return originalFile(f_name); or provide a virtual tpm).
Rooted devices aren't the problem, Python scripts pretending to be rooted devices are. There's just no way to distinguish between the two. The only way to disallow automated Python scripts from logging to your grandma's bank account is to also disallow you from logging into yours if your phone isn't blessed by Google.
Magnusmaster•11h ago
therealmarv•7h ago