Comment by pimterry

In what country do you live? In America, users are liable for the banks stupidity. If they don’t verify credentials and give away all of my money, I do NOT get it refunded, they are NOT responsible, and I am the victim of “identity theft.”

On the flip side, banks have the worst fucking security outside of demanding you use an app. Let me use 2FA that isn't bespoke.

I understand all that but I don't see how that's any less secure than a browser.

If they want to do it properly, they can use the Android hardware attestation:

https://grapheneos.org/articles/attestation-compatibility-gu...

As someone who used to work for a bank building applications I would say no. This is definitely a feature companies and organizations like banks would request if it wasn't available.

There are a lot of scams targeting vulnerable people and these days attacking the phone is a very "easy" way of doing this.

Now perhaps there is a more forgiving way of implementing it though. So your phone can switch between trusted and "open" mode. But realistically I don't think the demand is big enough for that to actually matter.

On the other hand, it's not really up to the bank. It's my money, not theirs.

I really wish I wouldn't need to have my money managed by some corporate drones in suits but it's really hard these days to do without a bank account.

This is why I was really into crypto at the beginning; it envisioned giving us control abck over what's ours. But all the KYC crap and the wishes of the speculators for more oversight basically made crypto the same nasty deal as the public banking sector.

It is desired enough that plenty of developers license third party libraries that roll their own device attestation, instead of or in addition to Play Integrity.

Is this not more or less what Manifest is attempting to do? The headline grabber is that it disables ad-blocking but it's essentially trying to establish the browser as a "trusted" (owned) platform, no?

Banks have never accepted browsers. They don't need to because they can require the web app be paired with a mobile app or SMS code to log in. Before they used mobile apps they issued smartcard readers (at least they did everywhere I lived). The smartcard readers were also used to digitally sign transactions.

In other words, there aren't many banks that let you take sensitive actions with just a browser and that's been true since the start of online banking.

These days they also apply differential risk analysis based on the device used to submit a transaction and do things to push people towards mobile. For instance in Switzerland there's now a whole standard for encoding invoices in QR codes. To pay those you must use the mobile apps.

Edit: people are getting hung up on the "never accepted browsers" part. It means they only use the browser for unimportant interactions. For important stuff like login or tx auth, they expect the use of separate hardware that's more controlled like a SIM card/mobile radio, smartcard or smartphone app. Yes some banks are more lax than others but in large parts of the world this was always true since the start of online banking.

Yeah, its like the world has been turned into one giant corporation, and the only computers you can use on it are corporate, botted, Active Directory joined, crap. All machines are belong to them.

Why can't "low end OEMs" release security updates?

Using Play Integrity for captchas is completely useless, criminals are using unmodified devices farms on racks anyways. Why would they need to modify their device?

Betting on Play Integrity to solve that is betting that devices will become more expensive in the future, that's quite obvious that the opposite is happening, they are getting cheaper and cheaper.

Using your dominance in one market to secure the dominance in other market is illegal monopoly, no matter how convenient it might be for a third party.

> if you don’t understand how and why these capabilities are used by services, I’m also suspicious you understand the harms accurately

Yeah, I see this mentality a lot on HN (and kinda everywhere for that matter). "Anyone who disagrees with me is evil, and must therefore have evil motives for everything they're doing. The reasonable/innocent explanation they give for why they're doing this must actually be a front for this other shadowy, nefarious motivation that I just made up on the spot, because surely nobody ever does bad things for good reasons. Certainly not those evil people who disagree with me!"

I hate having to defend Google here, because I think this is genuinely a terrible, freedom-destroying move, but malware on Android is a real problem (especially in Brazil, Indonesia, Singapore, and Thailand, where they're rolling this out initially) and this probably will do a lot to solve it. I'm just categorically against the whole idea of taking away the freedom of mentally sound adults "for their own good" regardless of whether it works or not, and this particular case is especially maddening because I'm one of those adults whose freedom is being destroyed.