Hacker News Reader

Comment by cnst | Hacker News Reader

I fail to see how your conclusion follows from the premise.

Banking apps in the US don't even show any PINs for 2FA, so, why exactly is Schwab doing that again?

BTW, Google Wallet does let you take screenshots of all the views except for just one or two views where you enter card number, billing and card security code. Honestly, even that is an overreach; it's not like I can't use the camera to take a photo of my credit card with CVV in view, so, why should the camera function of any app prevent that again? Google never blocks screenshots of any transactions, last-4 of any card, or any other screens. If they ever did, I'd be far less happy with them, and would go out of my way to find an alternative contactless provider. Wells Fargo used to provide contactless on Android in their app for their own cards, but, probably thanks to Apple, this feature was removed for feature parity with iOS.

View on HN

You're laser focusing on MFA sniffing, specifically. The point is that malware can take screenshots to harvest information. Your banking information has a ton of sensitive information about you that could be used for a variety of different purposes, such as for identity theft. My point was that making it impossible to take screenshots is trying to protect against the possibility that there is malware harvesting anything through screenshots.

>why should the camera function of any app prevent that again?

Because you taking a photo of it with a physical camera is intentional. Another app on the device screen recording that view may not be intentional by the user.

> Another app on the device screen recording that view may not be intentional by the user.

Given how many permission prompts you have to go through to let any app see your screen, I feel to see how it would be unintentional.

Not more then for any other app. Android design is such that it intentionally trains users to accept everything.

Surely you're talking about Apple's design, no?

With Android, I routinely prohibit random app permissions from many apps, and everything still works just fine.

Does Apple even let you have as fine of a control of permissions as you can have on Android?

Yes, more than anything else: https://github.com/cvzi/ScreenshotTile?tab=readme-ov-file#te... Depending on method and version of Android, you have to jump through ridiculous steps to allow screenshots.

Their point was that you have to jump through ridiculous steps to allow anything at all, so users are trained to jump through them.

I feel fairly confident asserting that users are not trained to go through the steps to enable screenshots. Blindly clicking allow is one thing. Going back and forth to enable restricted settings and then grant the permission is quite another. I use a screenshot app, and am pretty technical, and it took me multiple tries and several minutes including having to go read https://support.google.com/android/answer/12623953#allowrest... because Android is so concerned with protecting me.

Not screenshots specifically. Every app requires you to accept a whole bunch of permission prompts.

Yes, by blindly clicking allow. But in this thread we're arguing about specifically problems with screenshots, which are behind much stronger permission gates that can't be blindly clicked through.

Yes. Plus these are not even ridiculous steps, not for capturing the screen.

The bigger issue is users being spammed permission requests in broad categories that you cant deny. Like a headphones needing contacts permission.

Why would headphones need contacts permissions? Where are you getting these headphones from?

I routinely deny permissions to most apps on Android, and never have any issues. In my years of using random apps, the only app I'm aware of, which doesn't work without permissions, is Capital One banking app, which refuses to work unless it gets the phone permission. So, I just 1-star Capital One in the Play Store, uninstall as defective, and move on.

BTW, where are the permission screens on iOS? Or is the blissful ignorance more secure than being able to click "deny" a few times?

Starting the recording may have been intentional, but the recording of sensitive content may not be. For example Twitch streamers frequently leak their personal information by accident. If that personal information could automatically be blacked out it would save them from trouble.

Reply on news.ycombinator.com