14 ms·

I guess this will just mean even more mandatory apps with hardware-backed backdoor crap like SafetyNet et al., in the hopeless witch hunt for emulators. And of

I guess this will just mean even more mandatory apps with hardware-backed backdoor crap like SafetyNet et al., in the hopeless witch hunt for emulators. And of course, installing a custom ROM or otherwise degoogling will be considered criminal-like behavior not long from now. Look at the payment card industry: the whole system is fundamentally broken by design and has zero meaningful privacy and security since its inception, yet it somehow survives, decade by decade, with more and more layers of bureaucratic band-aid.

lxgr 3y ago
> Look at the payment card industry: the whole system is fundamentally broken by design Quite the contrary: The parts of it that are broken are broken due to industry inertia and backwards compatibility considerations. Payment cards have had the capability for strong cardholder authentication both online (3DS) and at the POS (chip/EMV and PIN) for almost two decades now. There just isn't political/regulatory will to enforce their use in the US, and nobody will move first without being forced (since it's game-theoretical/economic suicide to be the first mover). In the EU, both are now largely mandatory.
- ghaff 3y ago
  >POS (chip/EMV and PIN) Although I went ahead and got a PIN for my US credit card after I had an issue, I don't know the last time I've had to use it in Europe. I do sometimes scrawl a not really signature now and then.
  - lxgr 3y ago
    That still usually won't make it PIN-preferring. US credit cards request a signature by default; if you request a PIN, that's usually only ever used for cash advances, but not for payments, even in Europe. In other words, it's effectively impossible to get a PIN-preferring, i.e. more secure, credit card in the US...
    - ghaff 3y ago
      I wasn't clear. Right, you never use a PIN for a credit card payment in the US. You're sometimes required to "sign" but basically that can be an X these days if you like. Mine is an even lazier scrawl than my illegible signature. My comment was that I have been asked to enter a PIN in Europe which is why I requested one. But I've never used it since. You're covered for fraud by the credit card bank so, as a consumer, I don't really care about the level of security.

lxgr 3y ago

> Look at the payment card industry: the whole system is fundamentally broken by design Quite the contrary: The parts of it that are broken are broken due to industry inertia and backwards compatibility considerations. Payment cards have had the capability for strong cardholder authentication both online (3DS) and at the POS (chip/EMV and PIN) for almost two decades now. There just isn't political/regulatory will to enforce their use in the US, and nobody will move first without being forced (since it's game-theoretical/economic suicide to be the first mover). In the EU, both are now largely mandatory.

ghaff 3y ago
>POS (chip/EMV and PIN) Although I went ahead and got a PIN for my US credit card after I had an issue, I don't know the last time I've had to use it in Europe. I do sometimes scrawl a not really signature now and then.
- lxgr 3y ago
  That still usually won't make it PIN-preferring. US credit cards request a signature by default; if you request a PIN, that's usually only ever used for cash advances, but not for payments, even in Europe. In other words, it's effectively impossible to get a PIN-preferring, i.e. more secure, credit card in the US...
  - ghaff 3y ago
    I wasn't clear. Right, you never use a PIN for a credit card payment in the US. You're sometimes required to "sign" but basically that can be an X these days if you like. Mine is an even lazier scrawl than my illegible signature. My comment was that I have been asked to enter a PIN in Europe which is why I requested one. But I've never used it since. You're covered for fraud by the credit card bank so, as a consumer, I don't really care about the level of security.