On Android distros [LWN.net]

On Android distros

Posted Jan 3, 2025 9:06 UTC (Fri) by zdzichu (subscriber, #17118)
In reply to: On Android distros by leromarinvit
Parent article: Some things to expect in 2025

I believe they will be happy to let you go. The cost of losing one client is much much less than the cost of fraud the banks are on the hook for. They minimise their risk by requiring certain platforms with known security profile.

You may be tech savvy enough to secure your device, but you're an outlier among banks customers. It is safe (less risky) to NOT serve such complaining liability. Sorry, that's life.

(I've worked in three different banks in EU, I know some internals).

to post comments

On Android distros

Posted Jan 3, 2025 9:43 UTC (Fri) by Wol (subscriber, #4433) [Link] (3 responses)

> I believe they will be happy to let you go. The cost of losing one client is much much less than the cost of fraud the banks are on the hook for. They minimise their risk by requiring certain platforms with known security profile.

The problem is they are trying to force everyone on to mobile. I wanted to read the small print for a loan. So I logged on to the "bank" to look for it. Next thing I know, "give us your mobile so we can finish everything ..." with NO apparent way to bypass it!

With fat fingers and aging eyes, do you really think I want to read the small print on a screen I can hardly see!!!

I've got no security conscious stuff on my personal phone (other than 2FA for work), and I have no intention of putting anything such on it. Anything of note (that doesn't require a PHONE) gets done on a minimum 15" screen. Usually with a 24" monitor attached.

Cheers,
Wol

On Android distros

Posted Jan 3, 2025 13:00 UTC (Fri) by dskoll (subscriber, #1630) [Link] (2 responses)

That's really terrible. Here in Canada, all of the banks still support almost all banking via a vanilla web browser rather than forcing you to use an app. The only exception is remote cheque deposits.

If my bank forces me to use a mobile device, I'll switch banks. If all of them do, I suspect there will be a legal challenge, probably on the basis of accessibility. I doubt the mobile banking apps support visually-impaired users.

On Android distros

Posted Jan 3, 2025 19:31 UTC (Fri) by Wol (subscriber, #4433) [Link]

It was actually Volkswagen Finance. "Take out a finance deal and get a £4K discount" iirc. But from what I could make out, they added all the interest up front when calculating the repayments, and I didn't trust them to refund the finance charges if I repaid it early. That was what I wanted to check, and I got the distinct impression any refund was discretionary ... so if you took the loan to get the discount, then repaid it after a month or two, you could end up out of pocket. I chose not to take the risk.

Cheers,
Wol

On Android distros

Posted Jan 5, 2025 0:08 UTC (Sun) by jkingweb (subscriber, #113039) [Link]

> Here in Canada, all of the banks still support almost all banking via a vanilla web browser rather than forcing you to use an app. The only exception is remote cheque deposits.

RBC has a lower limit for Interac transfers via the Web than their app, too.

On Android distros

Posted Jan 3, 2025 16:20 UTC (Fri) by busman (subscriber, #7333) [Link] (1 responses)

Why mobile apps need such draconian measures while desktop browsers don't? I can happily use Firefox on Linux without my banks complaining but having *less* functionality in mobile clients is somehow more dangerous (for some of them)?

On Android distros

Posted Jan 3, 2025 17:01 UTC (Fri) by excors (subscriber, #95769) [Link]

I think it's not about "need" - it's a tradeoff between security and compatibility. There's no practical way to do this kind of integrity verification on PCs, and blocking access from all PCs would drive away too many customers, so the banks will put up with a certain level of fraud from keylogging malware etc. But there is a practical way to do it on modern phones, and blocking access from unverified phones would only drive away a small number of customers, so they've decided the reduction in fraud makes that worthwhile.

(My bank also makes the app much more convenient than the website - e.g. I can set up new payments through the app with just a fingerprint (and maybe facial recognition if it's a large amount of money), whereas on the website I need to type in my ID and password and then insert my physical card into a card reader to generate authorisation codes to type in. There's always a security vs convenience tradeoff, but the improved security of the phone platform means they can increase convenience and still keep fraud within acceptable levels.)

On Android distros

Posted Jan 4, 2025 5:12 UTC (Sat) by linuxrocks123 (subscriber, #34648) [Link] (3 responses)

Here in good ol' 'merica, I know of at least one major brokerage firm (perhaps THE largest) that doesn't even require 2FA ... anywhere :)

For that reason, I strongly suspect the "rooted Android = no banking app" problem is likely specific to over-regulated Europeans.

On Android distros

Posted Jan 4, 2025 13:32 UTC (Sat) by kleptog (subscriber, #1183) [Link] (2 responses)

> For that reason, I strongly suspect the "rooted Android = no banking app" problem is likely specific to over-regulated Europeans.

By "over-regulated" I guess you mean the banks can't tell the customer to suck it up if money vanishes from their account without the customer being involved?

Because banking regulations don't say anything about Android phones, rooted or otherwise. Or even apps.

On Android distros

Posted Jan 5, 2025 9:13 UTC (Sun) by LtWorf (subscriber, #124958) [Link] (1 responses)

my bank in italy retired the 2fa hardware tokens and moved to sending the otp via sms. They said it was because of european regulations. I went to read the regulation and it said to use hw tokens, prefer to avoid otp apps and absolutely never send the otp in clear text.

Banca san paolo if you are wondering. A very large bank.

On Android distros

Posted Jan 5, 2025 9:37 UTC (Sun) by Wol (subscriber, #4433) [Link]

Sounds right. Lorry drivers are allowed to drive a maximum of 13 consecutive days without a 2-day (45hrs to be pedantic) break.

One of my colleagues - responsible for enforcing the regs !!! - insisted that meant "one break every second week", and then designed our enforcement system to only look back 8 days. I still think he doesn't understand what's wrong - he hates the system I wrote to replace it ...

Cheers,
Wol