Hacker News Reader

What's the threat here? A bad impression because apps might crash on rooted phones? Because that's the only explanation I would buy.

Security? I highly doubt that this can be an issue here and I cannot follow that logic of yours, to be honest.

The type of person who roots their phone is almost always going to be technologically experienced

Unfortunately, it seems, the opposite is true: Rooting is often one of the "checklist" kind of things that you see on many misled Android forums, and it seems that many users do it...just because.

And now they have a platform that is often significantly more vulnerable.

I completely understand why services would block this -- it fundamentally breaks the protections of the device. Many widely referenced vulnerabilities of Android only apply to rooted devices.

How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.

The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns.

To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in:

http://www.aorato.com/blog/untold-story-target-attack-step-s...

Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.

it's the direct equivalent of UAC on Windows or sudo access on Linux

Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.

It's none of their business if I do or don't have admin access on my computer. If Barclays came out and said their website would only work on locked-down Chromebooks we'd all recognize it as absurd. It's actually kind of scary how brainwashed we've been in the mobile era into accepting this sort of thing as normal.

The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.

> I imagine that internally for Barclays it's a big move and a sensitive one. A security breach in the early stages would be catastrophic...

> A rooted phone is not a stable environment for Barclays to run their software - it could have been changed in any number of ways

This means it could be less stable, but I don't see how it would affect the possibility of a "security breach". You are talking about two different kind of issues as if they are related. Could you clarify?

By definition a rooted phone is compromised - a user has obtained root level privileged access. That's what 'rooted' means. The assumption is that it's the phone owner's actions that caused that to happen, but that's not necessarily the case. A third party could have rooted it. A local app exploit could have rooted it. Some clever malware that hasn't even been written yet that somehow escaped Android's security sandbox could have done it.

Ordinarily no one would care if a phone has been rooted or not. It's not important. But the point here is that allowing an app that has access to your bank account to run on a rooted device is assuming that the device was intentionally rooted by it's owner. For a bank that should be assuming far too much.

Actually they can only check for actual user-exposed way of rooting the phone. If there's a way some local app can do it, it doesn't have to expose this functionality - it can do whatever it wants to with it's elevated privileges and not leave a trace behind.

Local app exploit that messes with the bank app only will not be detectable by the bank app.

There's no reason for a clever malware to root your phone. "Rooting" only makes sense if you want to replace 'su' to grant root to different apps. If a malware escalates to root, it can just do whatever it wants, it doesn't have to "root".

Besides, even if the malware really needed to "root" the device, it could just use the same process has RootCloak[1] to hide that fact.

There's no valid security explanation; the app must designed assuming it's running on an insecure system, because there's no way of knowing if the system isn't lying.

[1] http://repo.xposed.info/module/com.devadvance.rootcloak

A third party could have rooted it.

This seem highly unlikely. In fact, I've never heard of it. And, add to that the serious hurdles I had to go through to root all the phones I ever rooted (3).

Your statements amount, to me, to overblown risk.

Sorry, sloppy language. I didn't mean stability in the normal sense - rather, homogeneity of the OS. I think that is connected to security: a rooted OS is more likely than a vanilla OS to cause software to run less predictably (probably mostly deliberate). This creates a definite security risk, and one that will be especially feared by a bank where confidence in its brand is at risk.

Barclays surely has a web app; not sure how a rooted phone is any more unstable/unknown than HTML/Javascript running on an unknown browser client.