logoalt Hacker News

AnthonyMouseyesterday at 6:05 PM0 repliesview on HN

There are essentially two separate issues here.

The first is the anti-trust angle. Some subset of bank apps don't work because of attestation and that's a significant barrier to adoption for switching to competitors, so it ought to be an anti-trust violation for the platform to do that.

The second is, you try it and discover that your bank doesn't work. If you want it bad enough you can switch banks, and the fact that it doesn't work is a signal that your bank has a weak security team who is just cargo culting deleterious vendor nonsense without evaluating whether it has any real security value.

(The use case for attestation is completely orthogonal to bank apps because it can't prevent credential stealing from compromised phones running a fake app since the fake app won't require attestation, and it can't prevent attackers from using stolen credentials to transfer funds because once they have the credentials they can just use a normal phone, and that's the case even if the attestation was completely airtight, which it isn't. Meanwhile the devices that can pass attestation are generally more vulnerable because it implies they're running the more-likely-to-be-outdated OS that came with the device rather than a third party upgrade with more recent patches, so they're essentially encouraging their customers to not upgrade their OS. Banks that do this are wearing clown makeup and you have to ask if you trust them with your money.)