Comment by MostlyStable
5 days ago
Maybe I misunderstood the point you were trying to make with your original comment, but you seemed to be suggesting that this piece of hardware could negate the risks (from the banks perspective), of allowing their apps to support non-secure devices. If your suggestion only applies to a very small subset of customers, then that doesn't allow them to put their app (which every customer can use), on the untrusted devices.
It does negate the risks, from both the user's perspective and from the bank's perspective. That's why I suggested it.
The existing customers of large banks who have hardware RSA devices are not "a very small subset of customers". Most of the customers who actually matter to the bank already have hardware devices, but with inferior cryptography and hardware aspects inferior to Trezor.
Boomers don't generally have Trezor wallets. Many millennials who aren't in the "failed to launch" category have a Trezor wallet or something similar, as do gen Z.
A Pixel running GrapheneOS is hardly a "non secure" device. As a user, I'm not naive enough to consider iOS or lamestream Android to be "trusted", which is why I run GrapheneOS.
If a bank's app runs on iOS or lamestream Android, but not GrapheneOS, it's not because those operating systems that aren't GrapheneOS are more "trusted", it's because the CTO of the bank is a fucking moron.
Trezor runs open source firmware. Solving the problem with a Trezor is what I want and what most loosely in the category of "hacker" want. Every legitimate IT pro will prefer, for securing their own bank account, this approach over another.
Whatever bank can set whatever threshold they want.
If they want to require a signature from a hardware wallet where their app runs on an unrecognized OS or for a Zelle transaction over $3,000 then they can specify whatever details they want in software at the speed of software. Banks already tune thresholds unique to customer's individual risk profiles.
As has already been widely demonstrated with some of the hardware keys in the Yubikey 5C family, users don't lose their hardware keys/wallets when they are attached to their physical key ring for house key/fob and car key/fob etc. Users cycle through or lose smartphones all the time but "muh keys" not so much.