Hacker News new | ask | show | jobs
by Bartweiss 3663 days ago
I'm relentlessly unwilling to use banking or shopping apps for similar reasons. Not only are they bloated and wasteful, they're typically pretty opaque, with a totally unknown attack surface.

My bank is barely competent to use HTTPS with valid certificates - why on Earth would I chance using their new-and-untested app when I can't see if it's worse than their website?
3 comments
brianwawok 3663 days ago
For banks specifically.. I can use an app to deposit checks via picture. I cannot do this via the website. So of my 20 apps I have installed, something like 3 are banks, 10 are games, and 7 are utilities...
link
0x6c6f6c 3663 days ago
It's a sweeping statement to say that banking apps are bloated. Some are very well made. I'm pretty happy with Chase's banking app to say the least.
link
superuser2 3663 days ago
There is very little reason to be tied into a particular bank these days. Why not switch to a more tech-literate one?
link
Bartweiss 3662 days ago
Most recently, regional branches. I was living somewhere pretty limited in in-person options, but I may switch now that I'm not.

The other answer is loans. If you get a good rate on a mortgage through a tech-illiterate bank, you're pretty solidly locked in.

link
superuser2 3658 days ago
There is no need to keep your checking where you have loans. I've also had success with running my main "hub" checking account out of an internet-only bank, with an account at a local credit union I use more rarely, when I need to do something in person.
link
praveenster 3663 days ago
In fact many of the banking apps seem to have stored usernames, passwords etc in the clear.

http://www.cnet.com/news/firm-finds-security-holes-in-mobile...

link
scarface74 3663 days ago
That was from 2010. Most banking apps on iOS use Touchid. If they are using TouchID, they have to store the passwords in Keychain which is encrypted. It's only after the user uses their password that the OS gives the app the stored password.
link
ashearer 3663 days ago
It's almost certainly correct that they use the Keychain for Touch ID. But I'd hedge that if they were bent on being insecure, they could use a different Touch ID mode that just returns a boolean. Does anyone know whether app review examines which mode they choose?
link