How is it usable if it is insecure? People bank on these things.

It’s not that you’re completely and totally wrong that makes me mad, it’s that you state everything with such an authoritative tone that people won’t doubt it and will get into a bad situation based on what you’re saying.

> Once you notify your bank or credit union about an unauthorized transaction (that is, a charge or withdrawal you didn’t make or allow), it generally has ten business days to investigate the issue. The bank or credit union must correct an error within one business day after determining that an error has occurred.

[1] https://www.consumerfinance.gov/ask-cfpb/how-do-i-get-my-mon....

> completely and totally wrong

Citation needed.

The U.S. Senate begs to differ.

Consumers defrauded on Zelle are left high and dry by the banks that created it [pdf] (senate.gov)

https://news.ycombinator.com/item?id=37438934

Transactions where you got scammed aren't the same thing as unauthorized transactions.

"Banks are not repaying customers who contest “unauthorized” Zelle payments – potentially violating federal law and CFPB rules."

I suppose you and Senator Warren have different definitions for unauthorized.

So, actually, 47% of them by dollar amount, according to the report you quoted. Selectively quoted. Why do you behave this way?

Here's a question for you to think about: Why do they reverse some claims but not others?

> Why do they reverse some claims but not others?

I guess that is the question. I'll be interested in the bank's reply.

Why is the word "unauthorized" in scare quotes?

And a lot of the complaint is about "cases where customers reported being fraudulently induced into making payments", which would agree with the ancestor comment.

Honestly I don't know. I copied and pasted the text and punctuation from the original document and it put them there. I also didn't do the research. The office of Senator Warren did. You can quibble with them. :)

> You can quibble with them. :)

The scare quotes imply that they are the ones saying the case isn't very strong, so I'm not quibbling with them, I'm trying to interpret them.

I've had multiple family members wait months to sort things out like that. Visa fraud experience is usually immediate, checking/savings accounts not so much.

Yeah.. good luck with that !

Motorola G6 Plus (and many other Android phones) is supported by LineageOS which is up-to-date version with security updates.

https://wiki.lineageos.org/devices/evert/

So to have an old phone that is still secure you have to know how to flash an OS onto a phone?

did you install the security systems for your house or car?

This is misleading, as the firmwares (binary blobs) most likely do not get updates.

I used to run LineageOS and some banking apps would not work as I had to unlock my bootloader.

This is truly ironical that some apps refuse to work on system that is much secure.

I use LineageOS and it is true that I have to use Magisk to have banking app working. And I understand that this is not for everyone.

I just wanted to mention that there is a way to use older phone and have security updates longer than vendor provides it. And even longer than Apple.

I get the argument about binary blob updates. Security is never 100%. And it also shows another reason why binary blobs make things worse.

He's using Firefox with updates. I guess they still provide browser updates for his version. TBH, that mitigates most of the real vulnerabilities.

It may even receive system web browser updates, as those tend to go on for much longer than OS updates with Android.

With a little care, it is likely to be fine.

These days "security" has been perverted so it is mostly not about protecting you from attackers, it's about preventing you from accessing your own data or running the apps that you want. You are the threat that they are securing against. Less "secure" means more freedom for you. Less "secure" can also mean more real security for you since you have to leave the mainstream which is what actual attackers target.

Using a non-updated device on the Internet is not smart if you have any personal information on the phone.

Plenty of people do it... And it doesn't actually backfire often - the worst that seems to happen is your phone will self-install unremovable adware if you visit the wrong website.

A complete reset solves it tho.

system might not be updated, but apps are. its not the end of the world in a realistic setting

I'd actually like to see a list of real world security incidents that occured on EOL android devices. Not out of date browsers. (Chrome can still be updated) but devices no longer getting OS security updates.. something tells me it's very very rarely if ever an actual issue in real life.

I'm not going to do a lot of research here but one thing I remember reading about was an uptick in Android Ransomware.

https://www.microsoft.com/en-us/security/blog/2020/10/08/sop...

In the article it explains how Google and the ransomers are doing a cat and mouse thing. If your phone is not keeping up, that could definitely be an issue.

An anecdote, but I've never heard anybody from my social circles to have their phone hacked. I keep reading about all these holes, but somehow they don't seem to be widely exploited in the real world.

I have a nexus 5x which I wanted to repurpose for… anything at all. It can’t even update itself anymore. Play services update just locks up or whatever. Play store is broken and can’t install anything. The thing is useless as a smartphone.

My iPad 5 got an iOS update last month-ish? And a security patch last week. All of my kids run iPhone 8.

you need to install the f-droid store. most google apps still work, but you can't use recent versions of them.

Who is updating the trust store? With root certs from 10 years ago a lot of TLS connections will not work.

Kitkat(Android 4.4) is 10 years old and I have experience with it. You can't update Signal since last year and you can't use it anymore since soon after that. Whatsapp didn't work anymore after May. And most(all?) of the phones bought 10 years ago didn't have kitkat yet.

Those two are the apps that survived the longest (Try getting any matrix client to work on it). Others broke sooner, most of them because the app developer has to enable TLS1.2 to be able to use it for HTTP APIs and many web servers disabled responding to older versions a while ago. Firefox (the one which allowed all extensions) still works. Great! But I can't message anyone anymore. On a phone.

TBH I put most of the blame here on app developers (supporting older stuff is not that hard) and some of it on the device manufacturers.