Is it possible to allow sideloading and keep users safe?

> The first is that a user has no right to run anyone else's code, if the code owner doesn't want to make it available to them. Consider a bank which has an app. /../ I think the bank has the right to say "your machine is too risky - we don't want our code to run on it."

But should they? Should we also accept Google's browser signing and ban all browsers the bank doesn't like? Am I allowed to accept calls from people they haven't vetted or is it too much of a risk to the bank's bottom line that they might talk me into a scam.

I suppose we should also write off the inevitable privacy and freedom violations in the name of "security".[0] I don't have anything to hide after all.

[0]: https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

> But should they? Should we also accept Google's browser signing and ban all browsers the bank doesn't like?

If you want to hold the banks liable for fraud committed against you (which is exactly what happens in many countries), then it’s hardly reasonable to say that they’re not allowed to use what ever technical options they can to prevent that fraud.

You can put forward the argument that banks simply shouldn’t be responsible for fraud committed against their customers. But we only need to look at world of cryptocurrencies to see how well that works in reality.

I think that makes sense if you also agree to not have any protections from them for getting scammed.

But otherwise I agree, I hate the same shit about requiring 2fa. Let me fucking decide about how much I care about my account being stolen.

Then that vendor need to go to /dev/null and end its business.

> it’s hardly reasonable to say that they’re not allowed to use what ever technical options they can to prevent that fraud.

Of course it's reasonable? You can give someone a job and also ask them to do it a certain way.

Plenty of banks will say "only available in Chrome" or "you must be running version xyz of your browser".

There are also banks which are app-only.

You'll also notice that modern phones have a "spam caller" feature. It either gets data from the phone network or from another source. Should your phone block the most obvious spam calls? Your email client already blocks spam.

At a network level, STIR/SHAKEN is also trying to block you from answering fraudulent calls.

These things are happening right now. I expect most people think a reduction in phone spam is worth the occasional false positive.

You may have a different opinion.

It's unreasonable to ask them to do a job, and then tie both their hands behind their back and tell them they have to accept being punched in the stomach and that they should be happy about this.

If you want to tax banks and pay the money directly to fraudsters, I guess that's a model you can aim for.

> Plenty of banks will say "only available in Chrome" or "you must be running version xyz of your browser".

Despite bogus requirements like these, websites have to rely on hacks to figure out what browser you're using, usually making it trivial to spoof (especially between browsers using the same engine). More importantly, websites can't prevent extensions from running, which I believe was one of WEI's goals.

> You'll also notice that modern phones have a "spam caller" feature.

I have yet to see a smartphone that enforces such feature and does not allow the user to disable or configure it.

> At a network level, STIR/SHAKEN is also trying to block you from answering fraudulent calls.

I am unfamiliar with STIR/SHAKEN, but Wikipedia describes it as "a suite of protocols and procedures intended to combat caller ID spoofing". This is fraudulent in the sense of "the caller is not who they claim to be," and not "this caller is on our blacklist" or even "is not on our whitelist". YMMV as some countries require GSM subscribers to ID themselves, but it's still far from a central entity deciding who is allowed to call you.

> You can give someone a job and also ask them to do it a certain way.

And they can say “no”. Which is pretty much what the banks do.

You might struggle to run a financial system without any financial institutions. Once again just look at the wonderful world of cryptocurrencies. They’re speed running all the historical financial scams, and rediscovering why financial regulation exists.

Obviously I'm talking about potential regulation, not individuals walking up to the bank and asking them nicely.

That’s a different kettle of fish, and to that I say, good luck.

Regulators are one of the entities pushing for these types of limitations. It’s a natural consequence of doing a risk assessment, very hard to justify not applying these limits when explaining to a regulator how you keep your customer funds safe. I’m speaking from experience here having worked with a team that attempted exactly that, but ultimately ended up adding jailbreak/rooting detection anyway.