News for hackers. Stuff that matters.

A comment on Unremovable malware found preinstalled on low-end smartphone sold in the US. Parent comment

Re:Unremovable malware found preinstalled on low-end smartph... by dathinab on Friday January 10, 2020 @09:45PM (#22017744)
The problem is that it's increasingly harder to run a non Google certified Android phone.

For example many German (EU?) Banks now have some form of 2FA system for credit card payments which requires a Android/iPhone app which does only run on non rooted certified phones. (Through it should be noted that in Germany credit card is not the major payment method and many people don't even have one, instead dbit cards with V-Pay, giropay, etc. are dominant. )

As a site note this is also the case for their online banking Apps, but you can just use their website instead.

[ Parent | on HN ]
Re:Unremovable malware found preinstalled on low-end smartph... by klingonopera on Saturday January 11, 2020 @09:00AM (#22019877)
> this is also the case for their online banking Apps, but you can just use their website instead.

...unless their website also has 2FA, and relies on an Android/Apple app for auth. Or you pay them money to lug around a USB device for 2FA.

For both people who have dumbphones or run custom ROMs, despite the security risks, there should still be an SMS-2FA option.

[ Parent | on HN ]
Re:Unremovable malware found preinstalled on low-end smartph... by deogeo on Friday January 10, 2020 @11:21PM (#22018106)
Sounds like it's time for regulation to step in and stop this practice.
[ Parent | on HN ]
Re:Unremovable malware found preinstalled on low-end smartph... by silon42 on Friday January 10, 2020 @11:21PM (#22018103)
Some web sites even require an android app to login (key generation)
[ Parent | on HN ]
Re:Unremovable malware found preinstalled on low-end smartph... by silon42 on Friday January 10, 2020 @11:52PM (#22018218)
Banks here used to support client digital certificates well, but have switched to this mess because of poor browser support (removing things like KEYGEN without viable alternatives).
[ Parent | on HN ]