linuxmemes

They 100% would stop you if they could.

It's why Google's website DRM thing was so scary.

I actually heard something about that in class not long ago

The story is that Android's security heavily relies on the compartmentalization of apps that lives in the android layer, over the Linux kernel. Apparently, that functionality works in part because only this layer can perform operations that require root access, no app or user can. So software that allows you to root your phone apparently breaks this requirement, and makes the whole OS insecure. He even heavily implied that one should never root their phone with 'free' software found on the internet because that was usually a front for some nefarious shit regarding your data.

I'm just parroting a half-understood and half-remebered speech from a security expert. His credentials were impressive but I have no ability to judge that critically, if anyone knows more about this feel free to correct me.

Because they want to "protect" you from "yourself". Imagine, you could scrape your own data that you can already see.

I'd be really worried if the security of server operation for my bank depended on the client-side. But playing devils advocate, some people will most likely point out that a root exploit on a phone may be unintentional and used to spy on people, to which I answer:

• show me a big scary box where I can "accept the risk" and move on
• keep in mind that if I am root on my phone, I can hide the fact that I am root on my phone and you'll be none the wiser

Currently, option 2 is in effect, sadly.

The reason is very simple: They rely on Google Safetynet (basically self-diagnosis). And that will immediately tell you off if it notices your device is rooted. And while you can have a lengthy discussion regarding whether this makes your phone less secure or not, this is another simple argument from Google's POV: The device has obviously been tampered with, we don't want to put any resources into covering this case. As far as we are concerned, you shouldn't use our OS like this.

So basically laziness.

Banks when you use browser 3 years of updates behind on Windows XP with multiple unpatched CPU vulnerabilities:

Google and Apple have been very successful at convincing everyone, including banks, to see the idea of users having control over their own phone-like computers as dangerous.

Because as per usual they don't understand security. I have started choosing my bank based on software they have. If software looks competent, that's my most significant influence.

They think rooted device = insecure device, but at the same time PC is even less secure and yet all the business users use them and more to the point have passwords written on a sticky note glued to the screen. My old bank at one point "upgraded" their software system and then started asking me for weird characters in password and then asked for maximum length which was the final sin I allowed them to commit. Left them that week.

Does your bank have a Linux application? Of course not, you're using the website. So why not use the website on your phone?

I was once working for a project in a bank, a developer answered me to why they go app only, because "you don't know what people do with their browser".

It's only about the feeling of control (and some paranoia), not about security.

It's not just root. They would prefer you not to have a custom keyboard either.

I can't believe I'm saying this, but thank God my country developers are incompetent.

I was greeted with this message:"This app can't be used on a rooted device" And I was prepared to go through hoops to get it to work. you know, fucking safetynet and all. But it turns out that the solution was just enabling zygist on Magisk.

My bank doesn't know for some reason. I don't even pass (~~as femme but that's not relevant~~) safetynet, but it doesn't seem to care. Sadly can't pay with my phone or watch tho

Let's be real here. Folks running Linux as thier desktop have a high chance of knowing what they are actually doing. Folks with rooted android phones have a high chance of having watched a 12 year old tell them how to root thier phone on TicTok. Which of these groups is participating in the more risky activity?

It's the banking equivalent of turning your device off for aircraft take off and landing.

If you keep doing stupid shit for long enough you can turn it into a religion. Huge profits will follow. It's also why the unexamined life is no life at all.

Btw, have you guys heard of Taler? It's pretty interesting and I think you will be able to use it with a libre app

NGI TALER is a pilot funded by the European Commission and the Swiss State with the very concrete objective to roll out a new, best-in-class electronic payment system that benefits everyone: people, merchants, banks, financial authorities, auditors and anti-corruption researchers. The project doesn't have to start from scratch either, but builds on the strong foundations of GNU Taler — the privacy-preserving digital payment system developed by the GNU community and Taler Systems SA with support from the NGI initiative. This offers privacy for those that make payments, while enforcing transparency on those that sell. By providing micro payments at very low overhead, GNU Taler permits internet business models to shift away from advertising revenue or subscription models, especially for online publishers. No-risk transactions can lower transaction fees and open online payments for the underbanked population and citizens marginalized from digitalisation.

https://nlnet.nl/taler/

bUt sEcuRiteeeEeeeEEE

There is no banking app for authenticating transactions for desktops?

Rooted mobile devices are a reasonable signal they been have hacked and security features might be disabled or work as expected.

It just banks, a lot of corporate security polices don’t allow rooted devices, as they could bypass mobile device management policies for devices owned by the company.

With laptops it’s a different story. Whether users have Mac, Linux or Windows, there’s a reasonable chance they have admin access too, so checking for root access is not such a useful signal there.