Contact me on matrix chat: @nikaaa:tchncs.de

  • 6 Posts
  • 438 Comments
Joined 2 years ago
cake
Cake day: January 12th, 2024

help-circle










  • I should be able to tell my bank to only trust devices running an OS signed by the grapheneos key, and more importantly I should be able to tell them to trust an OS signed by my key.

    How do you know that your OS installation doesn’t include malware? Like there have been many cases in the last few years where npm modules were found to contain malware. Who says that’s not also the case in some modules that are a part of your OS?

    And more importantly, who is legally liable if malware actually does cause harm? E.g. malware acts on your behalf and sends your money to some criminal organization. Not only did you lose money, but now you’re a suspect of supporting a criminal organization!

    Of course that issue might be alleviated if you simply don’t have any money to send anywhere in the first place. That might be a viable alternative, but it only works for some people, i’d say. Or you could also set a daily transaction limit of say $100 that you can use to buy groceries; to limit your losses that way. The limit ofc cannot be changed from your phone alone, you need to go to a bank physically to change it or sth. Otherwise malware could again change it on your behalf.



  • i’m just guessing here but i think that the critical requirements to be able to run banking apps securely on your smartphone are:

    • lockable/unlockable bootloader
    • quality control of the operating system to make sure it doesn’t contain malware/spyware
    • internet connection & open-protocol banking network

    the first two parts are general smartphone/laptop security and operating system integrity, which can only be done through hardware/general software developers. Like i think we need reliable hardware manufacturers but also institutions that check that open source software doesn’t contain malware. Like when you run apt install some-package who says that some-package doesn’t contain malware?

    The third one is the only part that is actually specific to banking. That’s a whole separate topic and has barely anything to do with the first two steps.