Re: Credit card: I own one, I can hand it out. Most of the information necessary to use it (name, number, CSC) are available if you hold that card for a second.
My (honest, I'm not trying to pull your leg or anything) question is:
I have a phone. I own it. You (payment provider) cannot control it and I might do stupid things.
I have a credit card. I own it. You (card issuer) cannot control it and I might do stupid things.
Where's the difference? How can CCs work, but Android Pay/Samsung WhateverWhyWouldIUseIt doesn't, given my current impressions above. Can you correct my errors?
Credit cards don't have radios in them with 24/7 internet connections and software vulnerabilities.
I think it is reasonable to assume, as mentioned elsewhere, that rooted devices are more prone to data-compromising attacks. And, due to security bugs, devices that are rooted may not have been rooted with the owners knowledge or permission.
It's a lot harder to attack at scale when targeting credit cards than an attack that targets mobile devices.
The difference is, you don't actually own your CC. You have physical possession yes, you can manage various aspects of it yes, you can even turn it off if you desire - but you don't own it. The bank does. The bank controls the card far more thoroughly than you do, including rights to create, replace, remotely destroy, cancel transactions, etc. You have the physical card and you can use it, but all of the permissions you have are rights granted to you by the true owner of the card - the bank.
its actually against the banks ToS to give your credit card to anyone else... even at the register.
but everyone ignores that :-P
Re:Introducing Netflix Stethoscope
by garaetjjte on Tuesday February 21, 2017 @05:45PM
(#13700866)
It's easy: just ask the user.
Re:Introducing Netflix Stethoscope
by lern_too_spel on Tuesday February 21, 2017 @06:11PM
(#13701096)
As if the user knows if they've been rooted by a malicious third party.
But suppose you established that the user intentionally rooted the phone (somehow). It'd still not be clear whether the rootkit that the user used was trustworthy. Even if you established that it was trustworthy (stretching the bounds of reasonableness; who is auditing these?), you couldn't assume that the user hadn't run other malicious programs. That last point is true for non-rooted phones, of course, but since this user had root access those hypothesized malicious programs become much more dangerous.
(Also, I doubt you own or have root access to your credit card. But what would you do with it if you did? All I can come up with is to consolidate a few of them onto one piece of plastic.)