Hacker News Reader

Comment by personZ | Hacker News Reader

The type of person who roots their phone is almost always going to be technologically experienced

Unfortunately, it seems, the opposite is true: Rooting is often one of the "checklist" kind of things that you see on many misled Android forums, and it seems that many users do it...just because.

And now they have a platform that is often significantly more vulnerable.

I completely understand why services would block this -- it fundamentally breaks the protections of the device. Many widely referenced vulnerabilities of Android only apply to rooted devices.

View on HN

How in the world does it fundamentally break the protections of the device? Your apps don't get root unless you give it to them -- it's the direct equivalent of UAC on Windows or sudo access on Linux.

The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns.

To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in:

http://www.aorato.com/blog/untold-story-target-attack-step-s...

Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.

it's the direct equivalent of UAC on Windows or sudo access on Linux

Indeed, it is. Do most corporate users run with admin accounts? Home users? In both cases, while the answer is unfortunately sometimes yet, it should always be no -- they are one confirmation away from significant peril.

It's none of their business if I do or don't have admin access on my computer. If Barclays came out and said their website would only work on locked-down Chromebooks we'd all recognize it as absurd. It's actually kind of scary how brainwashed we've been in the mobile era into accepting this sort of thing as normal.

The concern is more to do with other apps reading the Barclays app's private data on the phone, which is possible if the other app has root permissions. Without root permissions, the Barclays app data is safe and only readable by itself. In its app data, it is storing some sort of token that can be used to perform actions as the user, and it's only protected by a 5-digit PIN. So, if other apps were able to extract this data, they could brute-force the PIN offline and gain access to the user's account.

Reply on news.ycombinator.com