News for hackers. Stuff that matters.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by nimbius on Saturday April 06, 2024 @11:40AM (#39953168)
the only app ive seen balk at bootloader status (to date) is google wallet. Using a phone to pay for stuff is an opsec nightmare youd only entertain so long as becoming an integrated and saleable asset in a data brokers portfolio is a life goal. 'pm uninstall' and move on, the custom rom is still far more valuable from a security perspective than bending the knee to some bespoke ecosystem payment app (especially if you have an older device.)

the point of oem unlock, and rooting at all, is diametrically opposed to the vendors interest in nearly every facet. The vendor will bark "hackers" as a thinly veiled threat for the uninitiated, but we are initiated. what the vendor doesnt need you doing is erasing their telemetry and walled garden spyware. they dont need you developing alternatives to their store and to their apps, and they especially dont need you turning this effort into something as simple as an ubuntu installation for older phones they expect to follow the strict trade-in model of "buy a new phone every year"

arguably Asus refunded the purchase because this person isn't playing by the rules and being a good consumer.

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @11:47AM (#39953211)
> Using a phone to pay for stuff is an opsec nightmare

Do you mean "privacy nightmare"? Security-wise, Google Pay beats using your physical card since it uses a device-specific number that can't be skimmed by terminals and reused online.

> the custom rom is still far more valuable from a security perspective than bending the knee to some bespoke ecosystem payment app (especially if you have an older device.)

I'd argue that it only makes sense if you have an older device that's otherwise not receiving any more security updates.

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by kaszanka on Saturday April 06, 2024 @11:54AM (#39953250)
AFAIK it only beats magnetic stripe cards, not EMV chip cards
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @11:57AM (#39953282)
EMV chip cards still contain your card number and expiry date.

Skimmers would need a way to also learn the CVC2 from the back of the card to use it at most (but not all!) online merchants, but that's feasible using a small camera or a waiter/cashier accomplice doing the skimming.

With Google Pay and Apple Pay, and similar mobile wallets, that number is never shared during payments (and in fact not even stored on the device).

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @12:15PM (#39953399)
They do, but you can't get the card number from reading the chip. The protocol is a challenge-response one based on a private key stored within the chip.

https://en.wikipedia.org/wiki/Chip_Authentication_Program

You need to read the entire card number + cvc2 + expiry date with your camera. That's not skimming, that's just taking a photo of the card.

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by worewood on Saturday April 06, 2024 @12:24PM (#39953468)
Yeah, and it's easily solvable with a sticker or a dremel to scrape the number off
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @03:01PM (#39954578)
You can't dremel it out of the chip, though.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by justinclift on Saturday April 06, 2024 @08:42PM (#39957090)
Well technically you can. The card won't be so usable after that though. ;)
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @10:28PM (#39957654)
Destroying the chip is easy, actually chiseling away the correct trapped electrons making up the PAN in the EEPROM is the challenge ;)
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @02:04PM (#39954215)
No, you can most certainly get the card number and expiry via the chip and even over contactless, as it’s a vital part of transaction routing/processing. There are Android apps that can do it.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @04:17PM (#39955131)
If I could I'd delete my original comment since I did more research and you're right.

https://stackoverflow.com/questions/14861908/apdu-command-to...

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by M95D on Saturday April 06, 2024 @02:59PM (#39954564)
Any responsible user will learn the CVC, like any other password, and then erase it from the card.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by lxgr on Saturday April 06, 2024 @03:06PM (#39954618)
That seems like a lot of extra effort for something that's arguably not your opsec problem, but that of the card payment industry.

In the end, you'll always have to enter it on payment websites anyway.

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by didntcheck on Saturday April 06, 2024 @03:16PM (#39954683)
I can certainly remember mine from repeated use, but I can't say I've ever heard of someone erasing it
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by catlikesshrimp on Saturday April 06, 2024 @04:07PM (#39955045)
I have done it since many years ago
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by justsid on Saturday April 06, 2024 @10:20PM (#39957616)
You can always tell what part of the HN regularly goes outside and interacts with normal people. I’m sorry but “just memorize the CVV and erase it from the card” isn’t something anyone really does. The comment that Google Wallet is more secure is a generally applicable comment.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by M95D on Wednesday April 10, 2024 @06:40AM (#39989166)
You can always tell which part of HN does things right and which part does things easy.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Saturday April 06, 2024 @12:10PM (#39953359)
I'm in Canada and I can literally just tap the card itself on the reader. Every card has this ability and it can't be skimmed.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by SanDiegoSun on Saturday April 06, 2024 @01:59PM (#39954168)
There are many demonstrations of contactless cards being “skimmed.”

Unless you store it in a wallet with a faraday cage, this is a laughable opinion to express.

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by jjmarr on Friday April 12, 2024 @05:19PM (#40017782)
It's not the same as traditional card skimming since you can clone the magnetic stripe you skimmed onto another card and buy things with it.

If you grab data from a tap transaction, you can't use that data to perform another tap transaction.

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by paulryanrogers on Saturday April 06, 2024 @12:14PM (#39953388)
Bank apps, Netflix, and Disney+ also won't work. There are spoofing measures though I've been burned by unlocking and rooting too often to try again, at least not while my devices are still under warranty.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by mmh0000 on Saturday April 06, 2024 @01:02PM (#39953732)
My solution

* use bank website for the one bank that requires it, otherwise I got a new bank account without silly fake security.

* thepiratebay has everything Netflix and Disney does and it works anywhere

Re:Asus refunds Zenfone buyer for failing to provide bootloa... by catlikesshrimp on Saturday April 06, 2024 @04:10PM (#39955070)
I always use websites when possible instead of installing yet more spyware disguised as a useful app. My bank, however, has the TOTP built in the app. You can't make a transaction without the phone app connected to the internet.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by Vilian on Sunday April 07, 2024 @06:16AM (#39959763)
you can't use magisk to remove tho root and make it work?
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by catlikesshrimp on Sunday April 07, 2024 @10:44PM (#39965779)
I meant to emphasize that they force us to install their app. I can't use the website without installing the app, missing the point of using the website.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by luuurker on Saturday April 06, 2024 @01:09PM (#39953770)
Magisk + a few modules and most apps should work. The warranty part, this depends a lot in the country, but at least in Europe I don't think they can deny repairs just because you unlocked the bootloader.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by zappb on Saturday April 06, 2024 @10:56PM (#39957781)
Commercial copyright interests will always seek to maximize their control over the devices that play back copyrighted stuff. Banks at least have more legitimate security concerns since they involve the end user getting screwed rather than the copyright holder.
Re:Asus refunds Zenfone buyer for failing to provide bootloa... by cqqxo4zV46cp on Saturday April 06, 2024 @11:52AM (#39953234)
Your claim that using a smartphone for payments is a privacy(?) nightmare sounds quite baseless.

The more pertinent factor is probably the fact that you’re using an operating system built by an advertising company.