Kinda weird, if you think about it. But that seems to be the way it's heading.
No, the much more secure while at the same time liberty-preserving way to do this are heavily sandboxed secure enclaves with attestation, or even better standalone tamper-proof devices capable of attestation.
Like the ones practically every bank customer already has in their wallet, and for which most phones have a built-in reader these days... The only thing missing is a secure input and output channel, like a small built-in display and a button or biometric input.
In any case, I somewhat empathize with banks in that they want to ensure that my transaction confirmation device is not compromised, but getting to dictate what software does and doesn't run on my own hardware outside of maybe a narrow sandbox needed to do that is a no-go.
It's not money-preserving though. You need an extra device, and an extra phone number. The separate phone number is another privacy-preserving feature though.
A cheap Android phone is pretty much the opposite of a Yubikey, in terms of trusted computing base and attack surface.
That is one of the reasons the crypto market is behaving like some radical innovation instead of just a group of bozos speedrunning financial history. For the first time since the invention of capital we have an asset class where it doesn't take the cooperation of a group of armed thugs to guarantee the integrity of the system.
Merkle trees can prevent tampering after the fact, yes.
But if you include collusion, there's no way for the blockchain itself to know who is colluding and where they are so.
Smart contracts may be vulnerable or malicious.
Wallets can be emptied.
Centralized exchanges and similar entities still exist.
Policing systems are still needed, because as long as there is something of value and there is still "evil" in the world, someone will try to steal it or damage it.
My favorite, basic example is this: I'd like to create my own basic widget showing me my account balance on my phone's home screen. Doesn't have to be real-time, but accurate to +/- few minutes to what the bank app would say when I opened it. It has to be completely non-interactive - no me clicking to confirm, no reauthorizing every query or every couple hours. Just a simple piece of text, showing one number.
As far as I know it, there's no way of making it happen without breaking sandboxing or otherwise hacking the app and/or API endpoints in a way that's likely to break, and likely to get you in trouble with the bank.
It should not be that way. This is a basic piece of information I'm entitled to - one that I can get, but the banks decided I need to do it interactively, which severely limits the utility.
This is my litmus test. Until that can be done easily, I see the other side (banks, in cooperation with platform vendors) overreaching and controlling more than they should.
The point of the exercise isn't to just see the number occasionally; I can (begrudgingly) do that from the app. The difference here is that having the number means I can use it downstream. Instead of a widget on the phone screen, I could have it shown on a LED panel in my home office or kitchen[0], or Home Assistant dashboard. Or I could have a cron job automatically feeding it to my budgeting spreadsheet every 6 hours. Or I could have an LLM[1] remind me I've spent too much this week, or automatically order a pizza on Saturday evening but only if I'm not below a certain threshold. Or...
Endless realistic, highly individual applications, of a single basic number. The whole point of general-purpose computing empowering individuals. If only I could get that single number out.
--
[0] - Why would I want that is besides the point.
[1] - E.g. via Home Assistant.
Sure, you should definitely be able to do what you want with your computer, but you're actually demanding more here (at least in the case of transaction initiation and confirmation): For others to also trust the outcome of whatever you did on your own computer.
Banks are often legally required to cover losses resulting from unauthorized account access, so I can somewhat understand them wanting to minimize the chance of that happening. Sandboxed trusted computing, when done well, can strike that compromise much better than annoying non-solutions like root detection heuristics or invasive full-system attestation.
> As far as I know it, there's no way of making it happen without breaking sandboxing or otherwise hacking the app and/or API endpoints in a way that's likely to break, and likely to get you in trouble with the bank.
Banks should probably be required to make such a read-only API available (and in the EU, they are, to some extent – unfortunately only to "trusted", i.e. regulated and registered, service providers, raising the old question of who determines who is and isn't trusted). This is a very different story from transaction initiation.
Unfortunately, there are also caveats here. It's getting more and more common for companies to require me to "connect my bank account", which often means nothing less than granting them full and persistent account view access.
I think having the API still outweighs the downsides of others also starting to make demands for that access, but it's a slippery slope. For example, Airbnb not too long ago wanted full access to all(!) my Chase accounts to "verify my credit card".
Thats what is being required. The problem is making sure the policy is enforced correctly includes local business logic and user experience components. The money transfer needs to come from an authenticated user providing consent, not from some software that happens to have managed to get installed on the phone with sufficient permissions to interface with the secure element or to have their version of a library loaded.
That means one needs to validate user-facing software, and not just the API to a black box. Thus one is requiring a chain of custody validation up to the boot loader.
Much like I expect my employer to provide me hardware, and that hardware is used exclusively for work.
I shouldn't have to spend my own money on another device, nor should they be asserting their desires for control onto my own devices.
Otherwise, they just get to be OK with offering me a website or letting me transact with them on my own device that's under my own control without stipulations like requiring attestation, or prohibiting root.
The point is, governments nor banks or other private entities, should be getting to dictate what can and cannot be done on someone's computing device.
It's been popular demand, not financial institutions, driving the change to “the smartphone can do everything, I don't want to take debit/credit cards with me everywhere.”
People don't want an additional card, or yubi key, or printed second factor, or whatever, to authenticate.
They want an app that uses a data connection, and a fingerprint to replace even needed a PIN. They tolerate a second channel: an SMS, if the app automatically reads it. That's as much inconvenience as the general public is willing to put up with.
They're starting to demand that this works offline for smaller spends. And they'll put up with a phone call as a 3rd factor for when they want to unblock a really high spend, like purchasing a car, but it can't happen all the time.
They want this to work reliably, even on holidays, all around the world. And they want the banks to cover losses if it all goes south.
Now try to design a system that covers the requirements people are demanding for, without trusting the terminal the people decided they want to access it from.
Like....why can't we just go back to that? Banks were "fine"(doesn't mean happy) to shoulder the cost of these devices then.
Maybe in US. In Vietnam, $300 is the average monthly salary, and the minimum wage is around $150. Probably the majority of people don't have a primary phone worth more than $300.
A country that is a dictatorship - I can understand why their slaves have to go through this. I fail to see why a true democracy would do this though. There is zero need to be required to have a smartphone; all those transactions work perfectly fine on a desktop computer system too, under Linux. People then may have a second device at home, some card reader and/or a thing such as Yubiko or something like that. IMO not even this should be required, but to mandate an app that would not be permissive under Linux - that is true dictatorship. I am surprised the government of Vietnam went that way.
(From the kernel-level anti-cheat discussion the other day)
Just "a phone" with a bad update policy is $100.
Anything remotely more advanced than that, please let me use my computer and an app or website with, you know, an interface designed for more advanced operations.
Trying to do anything on a smartphone/touchscreen only device is nothing but an effort in pure frustration for me.
Of course in Canada we have a banking oligopoly that is effectively there just to rob people, but ironically any of the “challenger” startup banks are 100% app based afaik
I did install app from CIBC for one single and the only purpose - deposit cheques sent to me by clients to my business account without having to go to ATM or the bank teller.
> Of course in Canada we have a banking oligopoly that is effectively there just to rob people
In my experience they are more pleasant to deal with, tend to be smaller/more conservative with tech and you can speak to a human when shit goes sideways.
Mine has never laundered money for the cartels (unlike my other bank) which is a plus as well.