I used iOS and Android phones and I like both. However it makes even me nerveous to use a banking application or similar on an Android. Can’t imagine what kind of shit my dad would have running on an Android device with all the fake fishing apps, bloatware, tracking etc going around.
With a non jailbroken iPhone I have a lot more peace of mind.
Do these people not do banking on Windows machines? The malware situation was infinitely worse on Windows - I see an Android device with some unwanted ads maybe once a year from a friend or family member, but Windows devices are a weekly occurrence and the really nasty stuff - like password sealers and banking trojans do exist, but are extremely hard to come by on Android, compared to Windows where clicking a pop-up and a run button could leave you permanently infested.
They don't.
Almost everyone I know does banking exclusively on their phones. I do that too.
Sorry, legitimate Android app developers! I would like to pay you for the things you create, but your neighborhood is too sketchy for me to visit.
Using a smartphone for banking is really dangerous because banks often use a phone as a second factor and compromising the phone gives full access to your bank account. And many phones do not get security updates.
Even with a regular bank account in most of the world at least, it's tightly regulated and you're only liable for a small portion of the loss - on a credit card, generally nothing at all.
Even without OS security updates, generally browsers and other internet connected software gets security updates regularly, I'd trust a new user on Android far more than Windows because clicking an ad would not have a risk of getting them infected system wide without jumping through some serious hoops and involving a few exploits. On Windows that's one Run button press away.
I would argue it the other way round. On mobile (Android or iOS), apps have much fewer permissions compared to on desktop. e.g., one app can't look into the data of the other app. On desktop, it is possible to write a binary which steals user cookies (e.g., https://github.com/rash2kool/cookie_stealer). For all purposes, the binary would be legitimate, and no antivirus or OS APIs would mark the binary as bad.
However, on mobile, one app can't peek into the private data of the other app. So, the Uber app can't peek into my browser cookies.
- banks often use phone (for example, SMS) as a second factor for authentication, for example to confirm transactions. Compromising a phone thereforer provides full access to your account. Some banks even allow to perform payments by sending SMS without logging in.
- many phones do not receive security updates in time. And those updates close only public vulnerabilities.
- while Android has good permission system, many apps have a very wide set of permissions, including permission to read or send SMS messages, or permission to use accessibility functions, so compromising such an app can also be enough.
Ignorance is bliss.
From my point of view, the sandboxing and authorization model of iOS is way better than what is available on Android right now.
You could argue that newer versions of Android provide a way to ask for permissions, but suffices to target API level 22 on your app and you're off of it. And fon't get me started on full disk encryption and buggy TPM implementations on Android.
So.. what do you know that we don't?