News for hackers. Stuff that matters.

A comment on Apple reverses stance on Amphetamine App. Parent comment

Re:Apple reverses stance on Amphetamine App by zepto on Sunday January 03, 2021 @11:22AM (#25622667)
How would you know you were getting it directly from your bank?
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by Nullabillity on Sunday January 03, 2021 @01:10PM (#25623590)
Because presumably you'd be downloading it from your bank's website?
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by zepto on Sunday January 03, 2021 @03:00PM (#25624688)
What if that were spoofed?

How about if there was a supply chain attack on the bank’s software?

[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by loa_in_ on Sunday January 03, 2021 @03:07PM (#25624761)
If there was a supply chain attack, Apple wouldn't help you either as they get the app from original developers as usual.
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by zepto on Sunday January 03, 2021 @03:18PM (#25624853)
If there was a supply chain attack, Apple would disable the app.
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by wayneftw on Monday January 04, 2021 @12:22AM (#25628144)
Only if they knew about it. Same for your bank.

A hack is a hack. A single point of failure is actually worse for everybody.

[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by zepto on Monday January 04, 2021 @11:17AM (#25633298)
How would the bank disable the malicious version of the app without disabling the entire service?
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by wayneftw on Wednesday January 06, 2021 @12:39PM (#25660074)
How would Apple do it?

There are many, many technical means available to do this. I usually control security on my server...

[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by sellyme on Sunday January 03, 2021 @10:51PM (#25627775)
Then I'm already going to have some pretty major problems whether or not I install an app.
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by kungito on Sunday January 03, 2021 @12:23PM (#25623161)
You have to do phone activation through in person or via an existing bank app to activate your phone app in Europe
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by zepto on Sunday January 03, 2021 @12:36PM (#25623278)
What stops a malicious app from spoofing that?
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by arthurcolle on Sunday January 03, 2021 @05:16PM (#25625748)
TLS?
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by zepto on Sunday January 03, 2021 @07:03PM (#25626524)
How? A spoofed app would have the client certificate taken from the real app.
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by arthurcolle on Monday January 04, 2021 @03:22AM (#25628855)
but it wouldn't have the private key associated with the certificate
[ Parent | on HN ]
Re:Apple reverses stance on Amphetamine App by zepto on Monday January 04, 2021 @01:12PM (#25635456)
Client cert - not server.
[ Parent | on HN ]