Comment by TeMPOraL | Hacker News Reader

Comment by TeMPOraL | Hacker News Reader

Parent Full thread

> I've yet to see someone saying "oh, I'm so glad my screenshot was blacked-out because I didn't realize I was in a banking app". It feels patronizing.

Yes, this. Payment apps, government apps, IM communications.

The other day I almost rooted my phone in anger trying to get around this, before pausing and realizing that this would only cause even more problems with those apps, thanks to remote attestation "features".

My favorite recent case, I almost locked myself out of mobile government services when changing phones recently[0], and it would've made for a stellar bug report showing when "fail safe" design can easily become "fail deadly"[1], with UI view of access and invalidation history clearly showing the timeline of a problem... if only I could take a screenshot of it. But I can't, because "much sekhurity".

--

[0] - Well, it's not really that big of a deal. With government services, there's always a way back. Might involve walking to a local civil affairs office or, worst case, a police station or a notary, but there is a way back. Big cloud services, on the other hand...

[1] - Invalidating a certificate prior to issuing a new one sounds like a good security idea, but in the real world fails critically if the two operations aren't an atomic group. In my case, issuing a new certificate failed, and I ended up walking around for half a day with old one invalidated and not even knowing it.

On a similar note in terms of frustration, my bank ended up getting me to memorize my randomly-generated passwords twice because it blocked pasting. I guess it's to discourage writing them down in plaintext files, but I bet it just makes most people choose meaningful (and therefore weak and guessable) passwords.

I just ran into a signup/login flow that allows pasting of passwords to register but not to login.

Very frustrating.

I once ran into a signup/login flow that allowed 36 characters in password when signing up but when logging in, the password field was limited to 20 characters.

I think I must have changed my password several times thinking I just copied it wrong or it had special characters that weren't allowed, but nope, the truth was somehow stupider than that.

I've seen that too. I was so mad when I finally figured it out.

Same here. Luckily you can show two apps at the same time in Android so I just put the password manager above the bank's app.

> much sekhurity

This feeling usually hits me at airports, with my shoes off and water confiscated. The terrorists won.

So did the airport and companies selling you overpriced water beyond the security screening.

The terrorists and the large corporations are looking very similar these days.

Then they deserve you taking a photo with a second phone

Well, I did, after the fact, but it's only because I had a work phone on me (that doesn't yet actively block sharing to non-work devices).

I doubt most people have a second phone on hand, ready and able to capture actual screen shots when your phone is preventing screenhots.

There might be a market for a USB-C camera to take phone screen photos to immediately upload back into the phone.

Yeah, few moments ago it hit me there could be a market for a phone case with in-built camera(s) that photograph your screen at a shallow angle on demand, and transform that into a screenshot automatically.

However, my idea happens to hit a very new limitation: for some reason, "privacy filters" are suddenly a thing. New phones have them built-in as some new magic display function, and for everyone else, there's this mad marketing push to get people to buy and use privacy foils in place of glass/foil screen protectors.

IDK what's up with those. Since when "shoulder surfing" with smartphones is a real problem, and why do marketers and product designers bet there's so much latent demand for it?

Recently handled someone's phone who had it. Neat technology. But the use case for it doesn't make sense, for the reason you specified.

The only thing I could think of is if you want to browse TikTok or Instagram in public and don't want people seeing the weird shit that's on your algorithm, but even then, that's kinda weird.

We're heading for two devices, IMO. A useful one and one for communicating with bureaucracies.

And a third one for membership apps.

That's exactly my idea. My phone is a lost cause, not really "mine" anymore. The good thing is that I stopped caring about the device. I take what's cheap and well supported (Samsung "A" series is the right kind of boring to me), no more expensive flagships.

The "useful device" is a laptop.

> before pausing and realizing that this would only cause even more problems with those apps,

In my view that's a feature, not a bug. I refuse to use services that break under "reasonable" conditions (non-chrome, ublock, no widevine, rooted, etc, etc).

I feel that too, but the practical reality is, many services happily exploit the leverage they have over me - I need them more than they need me.

Banks are the canonical example - changing one is a huge hurdle, with consequences that can drag on for years. One by one, they're all ditching their websites (if they had one in the first place) in favor of apps. Even those with full-featured websites increasingly force you to use their app as the second factor to log in, confirm transactions, even confirm viewing some data. Some offer physical tokens, most don't advertise that, and it's only a matter of time before they convince regulators that Attested Phones are Safer and Everyone Has One, and that option will disappear. And because they want their app to be the second factor, they can argue it needs to be secure, creating demand for remote attestation, and boom - there goes your option to work around any other bullshit limitation they throw at you.

The day has only 24 hours, I don't want to spend them clearing bushes by walking off the beaten path wrt. every single important service - payment services, government services, IM services, ${whatever bullshit SaaS app I need right now because you're using it for the thing you just shared with me, and I need to view that}, etc. So I submit. So does everyone.

It's why I put blame on platforms here. Features protecting the device from the user should not be built in the first place - they always start justified by some legitimate security reason, and always end up broadly abused to serve business reasons.

Banks are the stereotypical example, but they are really not that hard to change, especially now that many decently reputable ones are entirely online. I've changed my bank in an afternoon.

Reply on news.ycombinator.com