undefined

points

[-]

For Google control is the issue (and the data flowing with it), not security, and once again we in Europe just swallow that shit and mess up our supposed "open" standards. In this case it really is because there are no competent people making these decisions. They just trust Google when they say: "It's for security".

I think what we need to do is all complain in the same way, something akin to: GrapheneOS is the most secure Android option, it's just not catering to Google by sharing all user data with them. You are falling for the false argument from Google that this is about security. It's not, it's more about sovereignty and control. And you and your bank are catering to Google/the US and YOU are throwing YOUR privacy conscious users under the bus, because you do not fully understand the forces at play.

Idk, this can be much improved :)

by Muromec7 hours ago|

parent|

[-]

> It's not, it's more about sovereignty and control

The bank doesn't care about either. It cares about the risks, costs and opinion of the regulator on how well it evaluates and controls those risks.

If risks can be transferred to an external party and DNB signs on it, sure. If DNB says reliance on this specific external party is a risk in itself, then sure, there will be a plan for that too. The plan could be "if google becomes a problem we can publish a new version of the app using grapheneos attestation anchors in N weeks"

by ale427 hours ago|

prev|

[-]

Of course they pass system integrity. The whole point of the thing is not "it should be secure", it's "the user has not messed with it so we control it".

by Borealid4 hours ago|

parent|

[-]

If the device is "insecure", doesn't that mean you - as a user - can exploit one of those insecurities to "mess with" the device without system integrity being aware?

Or are you saying the device is insecure BUT has no local privilege escalations you can take advantage of as a user?

by hedora3 hours ago|

parent|

[-]

It means the spyware information flow and Google's ability to remotely modify the device have not been disabled.

by Muromec4 hours ago|

parent|

prev|

[-]

It could have RCE but not privilige escalation. But I don't buy it, because 5 years without kernel patches is at least 5 escalation exploits being written by the an llm in 5 minutes

by Muromec7 hours ago|

parent|

prev|

[-]

Well, yes? The law says that the bank should do the thing and the bank does the thing to the best of it's ability, given what people usually work there.

by Sayrus7 hours ago|

parent|

[-]

> the bank does the thing to the best of it's ability

No they don't. At best, they do a cost-effective proxy for what should be done.

by Muromec7 hours ago|

parent|

[-]

Oh, you have no idea. It's not even about costs. In a 200 year old company the level of corporate disfunction and the average skill level of people is something else entirely. Nothing ever happens unless the regulator holds a blowtorch wired to a timer to the CEO's ass.