• SkyNTP@lemmy.ml
    link
    fedilink
    arrow-up
    6
    arrow-down
    15
    ·
    edit-2
    7 months ago

    You deftly evaded the leading attack vector: social engineering. Root access means any app installed could potentially access sensitive banking. People really are sheep and need to be protected from themselves, in information security just like in anywhere else.

    You don’t get a “accept the risk” button because people don’t actually take responsibility, or will click on those things without understanding the risk. Dunning Kruger at play.

    Why is this prevalent on Android but not desktop Linux? Most likely a combination of 1) Google made it trivially easy to turn on, and 2) the market share of Android is significantly large enough to make it a problem warranting a solution.

    The fact that you know how to circumvent it is inconsequential to the math above. Spoiler: you never were nor ever will be the demographic for these products, in their design, testing, and feature prioritisation.

    • cley_faye@lemmy.world
      link
      fedilink
      arrow-up
      20
      arrow-down
      1
      ·
      7 months ago

      Root access means any app installed could potentially access sensitive banking

      That’s not how it work. Having a rooted phone does not turn it into a digital farwest were every application can do anything. It becomes a permission like everything else; if you only grant it to safe stuff (like, for example, not granting root to a single app but using it to customize your phone through ADB), there’s not much to see here.

      • mystik@lemmy.world
        link
        fedilink
        arrow-up
        6
        ·
        7 months ago

        In fact, it can be better: having root means you can arrange additional ‘firewalls’ between apps and your data , or omit/falsify sensor data the the banking app should not need, that the Google is unwilling to implement.

      • markstos@lemmy.world
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        7 months ago

        The word “potentially” was critical in the parent’s comment. A banking app cannot be assured that other apps are prevented from accessing its data when the phone is rooted.

        • cley_faye@lemmy.world
          link
          fedilink
          arrow-up
          2
          ·
          7 months ago

          So? If I, the customer, want to access my banking info, on my phone, with whatever means I want, I should be able to. As I said, it’s not like every app gets root access, if I, as the owner of the device, explicitly gave root access to something, it’s for a reason.

          And the main point that a rooted phone can basically hide itself from any app remains; these “detections” are trivially bypassed in the exact situation they’re supposed to detect.

          • markstos@lemmy.world
            link
            fedilink
            arrow-up
            1
            arrow-down
            2
            ·
            7 months ago

            And if you don’t want to wear a mask on your face during a pandemic, you should be able to? Not everything is about you.

            Banks practice defense in depth as other security practitioners do. Not every defense will stop every attack, so a layered, overlapping approach is used.

            • cley_faye@lemmy.world
              link
              fedilink
              arrow-up
              2
              arrow-down
              1
              ·
              7 months ago

              You really are missing the point that if the device is rooted there is nothing an app can do to protect itself. Defense in depth is layering (sometimes overlapping) solutions that do something. Detecting root and saying “nuh-uh” is not doing anything.