← Back to context

Comment by AnthonyMouse

8 hours ago

> Revolut is notrious in this regard. If memory serves, they explicitly check the build string for LineageOS and block the app if it matches. The workaround at the time was to build the ROM yourself with a new build name string.

What possesses companies to do things like this? A customer running a current version of LineageOS is going to have better security than running the out of date Android version that came with the phone. An attacker who wants root on something that will run the bank app doesn't have to use a different OS, they can just use any of this month's CVEs to root the "approved" version. Even requiring the latest patches -- which would exclude entirely too many actual customers' phones -- wouldn't stop attackers from controlling their own devices, because they could root the device before installing the patch and then install the patch for the vulnerability they used to get root on the device where they already have it.

And attackers who are going to modify the system to carry out an attack inherently have some kind of software development capacity, so measures like this have no effect on them and all they actually do is interfere with the ability of honest normies to replace their out of date OS with a version that is less likely to be compromised by attackers.

Are they just taking kickbacks from Google or something?

6 comments

AnthonyMouse

Reply
pkal  7 hours ago

I suspect that especially banks have paranoid lawyers that probably don't understand the situation entirely, and perhaps because of that, mandate that all means have to be used to prevent non-official builds from being used, so that they cannot be sued (for some reason) if "something" goes wrong. Though I don't know if they are consistent and also apply the same reasoning to phones that don't have active security updates any more.

  • AnthonyMouse  7 hours ago

    I feel like "the lawyers told us to do something stupid for no legitimate reason" is just one part of a bureaucracy trying to blame another part for the fact that the bureaucracy itself is doing something stupid for no legitimate reason.