Hacker News Reader

Comment by lemonspat | Hacker News Reader

I want to agree with you, but I'm not going to use Cydia on my phone for my banking apps. At least the Apple app store makes some effort (liability is the wrong word) to make sure that my banking apps aren't fraudulent or scammer apps.

I have no such trust when downloading apps from alternate places

View on HN

But why would you have concerns downloading a banking app directly from your bank? You have trusted them with your money, after all... With apple, you can't install and run software even from sources you trust, outside of apple.

Apple policy could be described as an insult to the scientific principles that led to computing, let alone user rights to run software on devices they own (somewhat established in courts).

"In the famous Apple v. Samsung lawsuit, Apple even claimed ownership of geometric shapes such as rectangles with rounded corners", cited from The crisis of intellectual monopoly capitalism, Ugo Pagano

How would you know you were getting it directly from your bank?

You have to do phone activation through in person or via an existing bank app to activate your phone app in Europe

What stops a malicious app from spoofing that?

TLS?

How? A spoofed app would have the client certificate taken from the real app.

but it wouldn't have the private key associated with the certificate

Client cert - not server.

Because presumably you'd be downloading it from your bank's website?

What if that were spoofed?

How about if there was a supply chain attack on the bank’s software?

If there was a supply chain attack, Apple wouldn't help you either as they get the app from original developers as usual.

If there was a supply chain attack, Apple would disable the app.

Only if they knew about it. Same for your bank.

A hack is a hack. A single point of failure is actually worse for everybody.

How would the bank disable the malicious version of the app without disabling the entire service?

How would Apple do it?

There are many, many technical means available to do this. I usually control security on my server...

Then I'm already going to have some pretty major problems whether or not I install an app.

And that's great - the App Store serves a hugely useful purpose - but you shouldn't need to rely on an iPhone vulnerability and a jailbreak to opt out.

You don’t have to. You can get your banking app on Android.

Then get rid of the iPhone and use something like degoogled android with fdroid or debian on a pinephone.

Reply on news.ycombinator.com