Hacker News Reader

Comment by AshamedCaptain | Hacker News Reader

Including everything I could possibly ever want an Android device for, like my bank's 2FA program.

It's all been slowly cooking for a decade, yet people will still claim "but you can still do it with root, so it's as free as before!" (or some other ridiculously complicated workaround with lots of nasty side-effects)

View on HN

Yup. When I updated my company's secure development requirements, and compared them to others, I was confronted with a lot of choices that would increase security somewhat, but at the expense of user control of their own devices, like refusing to function if the device was jailbroken, or requiring the use of the system keyboard only (which is also an accessibility problem).

These are tempting choices, but they go a lot further than, for example, requiring only modern TLS ciphersuites to be used to communicate with my servers. They dictate the state of your entire device, and no one app or company should have that power, unless you work for the company and they issue you the device -- but even then, modern MDM/MAM can and should sandbox company apps from the rest of the device.

When I worked on iOS games, I ended up having to ban all jailbroken devices. I didn’t like doing it, but basically - every cheater we found was using a jailbroken phone, the number of non cheaters with jailbroken phones was tiny, and it would have basically taken up all my time to deal with cheaters rather than implement fun features. I’d have just ignored them if it wasn’t for the fact that they made the leaderboards look really fake.

“I didn’t like doing it” doesn’t make this any better. It’s just hammering another nail in the coffin of device ownership.

Please, our mediocre AA gatcha game did nothing to you nor the overall jailbreaking ecosystem. Don’t you think that’s being a bit dramatic?

They definitely overdramatised the wording, but their point is valid - the 'normalisation by a thousand cuts' is a real phenomenom, and a bad one.

I'll agree with that, but on my side I wasn't faced with a whole lot of options either.

As much as I want to agree with you, I can't blame Google here. Corporate security departments have bought into the idea that mobile is different and you can't trust the user with root.

Google has little choice but to provide them with the tools to detect root access.

Why? If Google didn't implement it, what would they do?

Not allow their cards in Google Wallet, and or only support web access to their functions.

Some of the entities that want it do have pull.

Exactly, you shouldn't waste your time with Android any more than with iOS at this point (same for banks that only provide 2FA on iOS/Android).

And while for years the alternatives have been almost nonexistent, we do have at least two now : PinePhone and Librem 5.

Reply on news.ycombinator.com