> Security updates are a must. Without them it's not a usable device

That belongs on https://twitter.com/shituserstory

Don't be arrogant and wrong at the same time. Not a very good combination.

As a bank customer

I want to buy a new phone when trying to access to my money

So that an IT manager at the bank can put a check mark next to a policy OKR

Not everyone cares about security updates.

> Not everyone cares about security updates.

OK.

But surely banks ought to. If you care about having a banking app, then you ought to care transitively.

Do they really? All they care is about some particular version of Android (like any other app). I don't think I ever saw any banking app which would check for presence of some particular security updates (not even sure if it's possible).

Right, like the good old "we care so much about security that we blocked rooted devices, but we make no effort whatsoever to check the security patch date":)

AFAIK if I use a bank app on an insecure phone, and they stole my money, the bank should give it back to me. Authentication is their job after all.

But it is not much of as a problem right now. They definitely try to push people towards more secure and up-to-date systems, but as now, you still can bank from insecure systems as well, and allow your account to be stolen.

None of my banking apps will work on a rooted phone, so I need to keep a 'clean' android phone around if I care to use their app. (I don't.)

Banks don't care about security. See e.g. credit cards where the numbers are just printed in plain sight for everyone to copy them.

It's supposed to never leave your pocket or your hand. Besides, if someone gets your credit card number and purchases something, you can charge it back. The vendor is supporting the risk, not you.

> It's supposed to never leave your pocket or your hand.

If you buy something in a store, you have no certainty that your CC number doesn't end in the hands of store personnel.

> Besides, if someone gets your credit card number and purchases something, you can charge it back.

You have to keep an eye on it. It is easy to overlook if the amount small is enough.

All in all, I wouldn't call this good security practice.

Banks don't even do 2FA properly. They don't care.

Not everyone cares about using condoms for one night stands. Would you apply the same approach to Windows workstations?

I, personally, do care. But I saw lots of computers with old Windows, like XP, 2003 and so on. On my current work we have dozens of customers with Windows Vista which causes lots of headache and significantly limiting us with development tools. Well, it works for them, so who am I to judge. All I can see is that not everyone cares about security updates, including Windows workstations which handle quite important data.

The fault is not with the bank, but with the vendor of the phone. The hardware is perfectly capable of running newer Android versions, but the phone simply doesn't support them.

This is especially the case with lower end phones. My mother (an immigrant whose family communicates via WhatsApp, and other free services) buys a new phone every year or so because her BoA, or transit app can’t be used without the version of Android that was never released for her phone.

It’s some real “serpent eating its own tail” sh*t if I ever saw it.