We should have the ability to run any code we want on hardware we own

Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures.

You can also choose to do your banking at the physical branch.

We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely available if you needed it as well; these permissions could be locked or frozen if there is concern about users, just like work devices are provisioned with limitations. It all depends on your threat model.

Also the good old phishing emails/links. So many people are simply unaware when a website is pretending to look like an app/floating window. Even younger people who you'd hope know better are falling for it today. I work on a PC game and players (mostly young adults) are constantly getting their accounts compromised by the same phishing sites that pop up monthly.

AI voice and video cloning scams are also only going to increase. Why would scammers need to get people to install random APKs when they can just impersonate a family member and tell them what to give directly?

To me it seems very much like the classic "think of the children" type argument. It's not going to really fix anything in the end but it will benefit Google.

In the netherlands we do not have physical branches anymore. They died out. All banking started to go through browser. This was very sensitive to malware and viruses, so two-factor was added through phones. Then less and less people had PCs because phone provides enough. Now mobile apps for banking is the only way to do banking. Or it is required for MFA. Even if you’re calling with the bank it is used as MFA

> You can also choose to do your banking at the physical branch

The ones banks that do have physical presence are closing left and right? Also, I don’t think I can money transfers at the physical office of my bank.

Phone scams have you install malware. Banks don’t know if you’re on the phone with the scammer, but they would like to detect if you’re using a screen sharing app on the password or transfer screens.

I still do banking through a random reader at ABN AMRO. I really hope they never get rid of it because I trust that little dumb plastic device 1000% more than my phone.

> Your parents are more likely to be a victim of a phone call scam than malware, even on PC. There is also no guarantee that malware will not slip through cracks of official stores or signatures.

So what? The lack of perfect security is a terrible argument against better security.

For example, lockpicks exist. Is that a reason to stop locking your house? Our TLS ciphers might eventually be broken. Should we throw away TLS and go back to unencrypted HTTP?

I'm not expecting anything to 100% stop all scams. But modern computer security is a joke. We could do an awful lot better than we are today at keeping people safe from this stuff.

> We already had "best of both worlds", especially on mobile OSes - granular permissions per-app were quite good, and on Android until few years ago root was widely available if you needed it as well

Yes. I want something like this on desktop too - but I want to own the signing keys, of course. It seems strange that this is so controversial.

Same in Sweden, physical bank branches are rare and even they will often require an appointment. All banking is through bank apps or websites, and you use 2FA extensively. Sweden's digital ID system is called BankID because it was made by banks and, initially, for banking, though now BankID is used extensively for all kinds of government and private services.

That doesn't stop scammers. They also keep getting more sophisticated, often using a combination of social engineering and technical skill, and they keep tricking people into giving them money. So unfortunately, while malware is pretty much a non-factor, scammers still thrive.

So far in Canada... I must reiterate this, so far, this can and has been fought by one thing. Rural life, and nationalism.

There are plenty of places where mobile phones don't work, especially in the summer when there are leaves on the trees. This means SMS won't really work. So for this path, SMS, the bank has an alternative -- call a number on your account with a voice reading the 2FA code. Thus, landlines or VOIP work here.

When it comes to an app, forcing Canadians to use a phone OS controlled by US companies, still has pushback. An example being, the concept of "A Canadian having to use software from a US company, to identify themselves to a Canadian company" is still a hotspot. Especially with the US wanting to annex us.

So this lock in has not yet occurred.

Really, the phone call to a phone number on your account, not using SMS is as solid a protection, as an app running on a phone controlled by a foreign country's company. It's an alternate path. And it solves the whole 'rural person' access.

Many people living in rural areas don't even bother with a phone type device. Some have Kindles. But by buy a phone, if it doesn't work where you live?

This logic, combined with them closing rural banks, means they have to be quite sensitive here. EG, closing rural banks, then making it difficult to do online banking is political poison for our banks.

I wouldn't be surprised if it becomes impossible to even use cash in the Netherlands soon enough. The first year I was here I don't think I did even once. I've been using cash a lot more lately just out of principle and it's annoying - lots of pin-only check out lines, etc.

What is a "random reader at ABN AMRO"?

Physical OTP generator. Stick your bank pass in the plastic decice and type your pin in the calculator like front and it will give you an OTP for online use.

Laws would need to be changed for that to happen, so don't expect it anytime soon. Also, cash is kind of the one remaining option when there's no electricity. So for disaster planning people have been asked to keep an amount of cash around. With recent developments in European security, the need for this has become all the more clear.

Even better, the system that Rabobank has.

They make you use this separate device to scan a color qr code generated by the app. The details of the transaction you're authorizing are then displayed on this completely decoupled device, no internet, nothing. After keying in your pin you're given an OTP to put back into the app to authorize.

And I haven't checked, but I'm sure the 'payload' the qr code conveys is signed.

It's not about being defeatist, atleast not for me. It's about what is considered good enough.

Sure, locking down the OS in this way is more secure, but it's also very restrictive and personally I don't think the added security justifies this. Lock picks do exist, but I am still entirely content with a single lock on my front door. I do not need an extra biometric sensor or camera or security representative standing outside my door to check id's of people passing by in order to consider myself reasonably safe.

Maybe this is cultural/geographical, but I've yet to hear of anyone who lost access to their mail or had unauthorized access to their bank account as a result of malware. I'm sure you can find examples, but I do not consider this an attack vector that is prevalent enough to warrant requiring signed apps or preventing manual installation.

This hardly stops anything, app stores are full of malware, and the cost is very high.

It's like having an automated turret on your lawn because sometimes people bring bad snacks to your dinner parties.

Good to know. People should read this when they say cryptocurrencies are bad. Well, guess what, so is cash and your card. Any alternatives?

> The ones banks that do have physical presence are closing left and right? Also, I don’t think I can money transfers at the physical office of my bank.

It's crazy if you really can't

I don't think Google play integrity and only allowing installing blessed apps on blessed devices is more secure. I just don't.

Google blesses malware all the time because otherwise they would go bankrupt. They're an ad company, not a security company.

Cryptocurrencies do not solve any issues described above. It even solves fewer of them as there is no bank giving you support or giving back insured money

They could, but in any case, any alternatives to cryptocurrencies, cash, and cards?