Anti-web discrimination by banks and online services - is this even legal?
Anti-web discrimination by banks and online services - is this even legal?
Banks, email providers, booking sites, e-commerce, basically anything where money is involved, it's always the same experience. If you use the Android or iOS app, you stayed signed in indefinitely. If you use a web browser, you get signed out and asked to re-authenticate constantly - and often you have to do it painfully using a 2FA factor.
For either of my banks, if I use their crappy Android app all I have to do is input a short PIN to get access. But in Firefox I also get signed out after about 10 minutes without interaction and have to enter full credentials again to get back in - and, naturally, they conceal the user ID field from the login manager to be extra annoying.
For a couple of other services (also involving money) it's 2FA all the way. Literally no means of staying signed in on a desktop browser more than a single session - presumably defined as 30 minutes or whatever. Haven't tried their own crappy mobile apps but I doubt very much it is such a bad experience.
Who else is being driven crazy by this? How is there any technical justification for this discrimination? Browsers store login tokens just like blackbox spyware on Android-iOS, there is nothing to stop you staying signed in indefinitely. The standard justification seems to be that web browsers are less secure than mobile apps - is there any merit at all to this argument?
Or is all this just a blatant scam to push people to install privacy-destroying spyware apps on privacy-destroying spyware OSs, thus helping to further undermine the most privacy-respecting software platform we have: the web.
If so, could a legal challenge be mounted using the latest EU rules? Maybe it's time for Open Web Advocacy to get on the case.
Thoughts appreciated.
You're viewing a single thread.
That's a safety thing. Phones are usually owned by one person or possibly shared in the family, but the security is such that app data is per-user anyway.
Websites though, people still sign in from all sorts of devices and often wildly insecure ones such as public/work computers, one malware away from hackers having access to your bank account.
Inconvenient for advanced users like us, but it would literally make all of those refund scams so much easier to pull off because they wouldn't even have to trick the victims into logging into their bank: blank the screen, transfer the money, tell them their computer is all fixed, bye.
The security hole here seems to be remote control of devices, more than the nature of the software used.
If your bank really spies on you through its app, I would change bank. Neither of my bank apps even run in the background or even request sensitive permissions. I will happily change my mind if you can show any proof that this is happening.
It's purely security. On Windows and largely on Linux desktop as well, any app can easily look at other app's data, that's why there's so many browser credential stealers. Maybe you'll never be a victim of this sort of attack, but if it does happen your bank account is gone.
Android and iOS have complete data isolation between apps. Unless you have root on it, even if you install malware and give it the maximum amount of permissions Android can possibly give, it can't access your auth cookies from the bank app. The bank app can't even access them either until you input a pin or biometric data to get it from the TEE.
Thus it's safe for banks to actually let people stay logged in with reduced identification. Browsers can't do that, not without the web integrity.
We're an absolutely minuscule minority that cares, and could use a stay logged in feature safely in a browser environment.
Dealing with fraud cases is expensive for the banks, they have good reasons to ensure you can only access your bank account under safe conditions. The average person doesn't even know what a web browser is, they know they click the Google and enter what site they want to go to into Google and search for it. They're the people that get scammed on the phone. They're the people that have their entire life savings wired overseas.
Just let your password manager fill up the login everytime, it's not hard.
Your points are of course valid but this is getting slightly offtopic.
If your bank really spies on you through its app, I would change bank
What would be nice would be not to have to use a proprietary app on a closed-source software stack in the first place, given that it clearly represents a privacy compromise. And that is possible: almost no bank makes it obligatory. But they would obviously love to. If only to fire their web team and save some money.
And this is not just about banks. Every online service is trying to force us onto the closed platforms of Google and Apple, when an open-standards software platform exists and is perfectly workable. Seems there might be a battle worth fighting here. Nobody much seems to agree. Fair enough.
Just let your password manager fill up the login everytime, it’s not hard.
IME that hardly works any more, as mentioned.
on a closed-source software stack
Android is open-source. My phone runs an open-source build of it.
At this point it's barely any worse than a web browser. I know it's sandboxed, it can't access anything I don't want to. All it lacks is isolation with the kernel since web browsers run JavaScript and Android runs native code.
Worst comes to worst you just run the app in Waydroid.
Good points.