Do you have some relevant sources about banking fraud? Android devices make up more than 70% of Thailand's market share [0], so it's not a surprise.
[0] https://www.statista.com/statistics/814490/market-share-mobi...
Also, the government mentions that the scams affect users of both platforms, because the scams propagate via calls, web links and emails that ask for personal information[2].
[1] https://www.bangkokpost.com/tech/2487659/phone-users-warned-...
[2] https://www.bangkokpost.com/business/2499931/online-scammers...
I'm not saying iOS is 100% bullet proof. I'm saying the problem is much more manageable without sideloading.
> Right, but for Apple to take down those apps, it's much easier than taking down some random link the fraudsters put up.
Seems like the issue here is that the government has to tell iOS users not to install specific apps because Apple hasn't taken them down. I'm sure it's easy for Apple to do what it wants on the App Store, the issue is making them care. They have a history of letting multimillion dollar scams flourish on the App Store[1].
[1] https://www.theverge.com/2021/2/8/22272849/apple-app-store-s...
The banks then reply and say “the fraud transaction originated from customer’s device”. When you look at the screenshots of victims giving example it’s all Android as far as I can see.
Generally after talking to the banks and customers discover that it was their own fault for clicking on a seemingly harmless link they shut up and go quiet.
This is a story that plays out often here.
I don’t particularly have a link because these cases get deleted from social media (by the customer themselves) after the bank has proven that it’s the customers fault.
Edit: You can try searching the internet for “mobile banking fraud Thailand” you’ll find these links, here is one example.
https://www.bangkokpost.com/business/2524469/mobile-banking-...
Edit: here is an example the article mentions downloading of .apk on android
Each year the central banks up the ante on security protocols to implement to stop the fraud. I should know I used to work for a finance app here in Thailand.
We have to go through strict security audits, and procedures that costs a lot for any financial institution to implement.
Doing 2 FA is already a mandate for doing transactions. However 2FA in Thailand is mostly done using SMS which is still not that secure.
Forcing everyone to use a token or a 1Password app is also not viable since that’s going to shut a lot of people out of mobile banking.
It’s a complex problem, which I think Apple has already solved. Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
Guess what happens currently on iOS instead? Instead of installing a custom app, you are sent a link to log in to a dodgy bank page with all your details with the exact same result.
>>Disabling sideloading reduces so much costs downstream and made things simple and secure for the lay man.
I don't believe this is the case, and I really believe any arguments otherwise are made in bad faith to maintain the status quo because obviously apple could never do any wrong.
How?
What kind of token? How does it obtain it?
Any way to circumvent this requires app isolation to be broken somehow.
Also, I wouldn’t personally describe an out-of-band token delivery / exchange mechanism like that as “actually trivial” for apps to do.
Tokens embedded into your app can and will be extracted. You can make life harder for criminals by rapidly updating tokens and invalidating all but the last X updates, but I doubt your users are going to like that, and I doubt criminals will be stopped for long with the amount of money at stake.
There are ways to make it incredibly difficult for hacked apps but if the file ends up at a user's device, you lose control.
>>that'll just create a market for pre-jailbroken devices.
I don't understand - people will get pre-jailbroken devices so they can be hacked easier? The whole idea with forcing apple to allow sideloading is that you can be on the very latest, most secure iOS version and sideload apps.
Not to mention that iOS apps keep those kinds of secrets in the Secure Enclave and you can't get anything out of it unless you are the app that put the secret in there in the first place - that doesn't change whether apple allows sideloading or not. If you need a jailbreak to break that protection then this isn't something that will affect your "normal" user like many here are worried about. Normal iOS protections will be more than enough.
This is irrelevant because banks need to support people using older versions of iOS as well.
> Not to mention that iOS apps keep those kinds of secrets in the Secure Enclave
iOS doesn’t store tokens in the Secure Enclave. It can generate keys and use them to sign things, but keys and tokens are different things. The Secure Enclave isn’t a generic secret store, it has very specific, limited functionality. Are you perhaps mixing it up with the keychain?
Also, you didn’t answer the question:
> What kind of token? How does it obtain it?
It’s still unclear whether you are thinking of a static token bundled with the application or a per-user token obtained during first use. In the former case attackers can just download the IPA and extract it themselves without even thinking about attacking a user’s device. In the latter case, you need a mechanism to distribute tokens to untrusted devices, so that is the most likely entry point for an attack, not trying to obtain an existing token after the fact.