Hacker News Reader

Comment by chrsstrm | Hacker News Reader

My worry is that this is a gateway drug to "Fingerprint protect all the things!"

My bank emailed me the other day with an announcement that I could access my account through their app via my fingerprint. WTF? My text messages are one thing by now my money is protected by just my fingerprint? I took my bank to task because they allowed my username to be twice as long as the allowed characters in my password. Someone at the bank said, "Hey, all these new-fangled phones have fingerprint readers, why don't we tap into that and sell it as a feature?" When everyone is doing it, no one is going to stop and ask if they should, it's just a race to incorporate the newest features. Normal people aren't asking if this is secure, they are buying into the marketing copy pushed on them, so they start thinking that it has to be secure, because why would my bank not have my interests in mind?

View on HN

What can the bank app do? Mine can only deposit and view accounts, not withdraw or transfer. Open access to it would be weird, but not much worse than someone fishing my ATM receipts out of the trash to see my balance.

It's Bank of America, so it's about as feature-filled as a banking app gets. You can do all the normal stuff like check balances and deposit checks, but you can also open new accounts (including credit cards) and transfer money (between other accounts you own or to other people outside the bank). And yes, the app has the ability to add new transfer recipients, which only needs their email address or phone number. There is a protection to guard against unauthorized adding of new recipients, but you guessed it, the protection is in the form of a 2FA code sent via SMS. So if you're already in the phone and in the banking app you can add yourself as a transfer recipient with your email address and verify the recipient addition because you can read the incoming text messages too. And the warning email that comes when you add a new recipient and initiate a new transfer is likely going to come to the same phone you're currently holding. If you get into my banking app through my phone you can send yourself as much of my money as you want and cover your tracks so I wouldn't know until my next statement comes, and to top it all off, it looks like I was the one who sent the money to you, so how am I going to argue that I didn't?

Thank you for validating my decision to not put any BofA online banking apps on my phone.

This is scary enough I'm uninstalling my app just incase they add these "features" in an update. Thanks. Oh well, no big loss.

Yeah, no-one will steal your fingerprint, just like no-one will crack a reasonably strong password. But if every site has a copy ...

It's quite possible that your fingerprint has already been stolen

http://www.theguardian.com/technology/2015/sep/23/us-governm...

The bottomline is that if someone can hack a server to steal your fingerprint, they can just as easily use the same method to steal your method so I don't really see the differen imho.

Except that you can't choose a different fingerprint for each app/site. Lose it once and all your accounts are compromised.

All the apps that I use give me the option to not use fingerprint login.

The bottomline is that someone doesn't need to hack a server to steal your fingerprint, you leave those everywhere you go as virtual gifts to any passers-by. All they need to do is steal your phone, and that's pick-pocketing level easy.

Ummm, if I lose my phone, I'm just going to remotely disable it so there's no way the person who stole my phone can reach my data.

So, you're using full-disk encryption on your phone and the remote kill switch flushes the key?

Otherwise the data is still there in the plain, accessible by anyone who can read the flash.

If you're using a Nexus 5X or 6P on Android 6, then probably yes.

Android 5 has full disk encryption but was disabled by default on the Nexus 5 (and most other phones) due to performance issues.

Do the Nexus 5X or 6P finally have hardware encryption support ?

I didn't notice any mention of those, specially because they failed miserably last year parading full disk encryption on Nexus 6 and got bitten when reviews showed the performance degradation and lack of hardware encryption.

It's a good question, I've looked and the Qualcomm Snapdragon 810 has the support needed, but I don't know if it'll be enabled by default or not in Android 6.

If it's not, then Google are starting to take the piss..

*steal your password

Fair point, it should be used for convenience, not for real security.

.. non-hackers will equate it with security.

Non-hackers aren’t responsible for data security. Well, except for Sony. And every other company that doesn’t deal with data security in particular.

Reply on news.ycombinator.com