Hacker News Reader

Comment by atahanacar | Hacker News Reader

I don't understand why banking apps don't work with root/ROMs. In my country, if your phone is rooted or you have a custom ROM installed, banking apps just warn you about it, saying "Your phone is rooted, if you don't know what it means your safety could be compromised", allowing you to disable further warnings.

View on HN

Which country is that, if you don't mind me asking? My experiences have been either a) cancelling my account with no notice due to a policy change (Revolut); b) no cares whatsoever (Monzo, a UK digital bank, TSB, a UK traditional bank, or Danske Bank, a Danish traditional bank) or c) a national identity system (MITiD, a Danish single sign on) blacklisting my account instantly and requiring a single, fragile, loseable, unbackupable hardware dongle after much grilling from a local official.

I'm using lineage on a OnePlus 5. It's old but works perfectly!

Turkey. I've tried 4 different banks and so far all of them had a similar warning but worked completely fine.

The other angle to this is that going increasingly web/app based lets them shut down local branches. For my city the last permanent branch is closing soon so should I be locked out of an app the alternative would be the website which last I checked was designed for desktop browsing, or in-person service is a 6 mile journey to a 'mobile branch' available for 45 minutes a week.

I'm currently using an old PixelExperience build which takes some efforts to hide it's unlocked/custom rom status (right now it passes basic but not strong attestation). What I really wonder about is while we don't have the software environment that the OS isn't tightly coupled to the handset (i.e. generic system images) where the optimums are for security if someone doesn't regularly upgrade phones to maintain support from the original manufacturer. The most recent official android for my phone is 8, I'm running 9, so that's at least 5 and a half years old.

From a glance at XDA there's a collection of 11-14, however that brings up another issue of being able to establish trust in whoever is building your OS. Is an individual volunteer graciously building the latest version producing a recent version better than an older build from an established organization like lineage, or better than the ancient official build. Would my phone be seen as more secure by restoring older software and relocking.

There's a number of factors in balance here I'd love to hear views on from someone involved in consumer bank app security, as much as they're able.

Still more secure than using a browser on Windows, I guess. If that's acceptable, an outdated version or a custom ROM should be even more acceptable. Devs can also selectively disable features that they might deem too insecure.

I guess they want to avoid possibility of such user reading the apps memory which would be possible. Or protect a clueless user from themselves if their phone is infected with malware etc.. (Though here I agree, "I know what I'm doing" popup would be better)

that is very proper IT wise from them

During the late 90s, Turkish banks had to invest quite heavily on their IT infrastructure after new regulations. All that investment paid off in my opinion, as we can enjoy very high quality mobile and online banking.

Having a young population is also a big incentive for banks and government to invest in relatively newer tech.

Just like in Poland. And it’s also the reason why Poland and Turkey were top 2 countries for many years in contactless payments adoption. We were using it en masse as early as 2010-11.

Reply on news.ycombinator.com