Hacker News Reader

Comment by zozbot234 | Hacker News Reader

Just buy a separate low-cost device and use that only for your banking. It's a total non-issue, there are way more nefarious uses of SafetyNet/the attestation API's.

View on HN

It's not just banking. Though that's clearly the most inconvenient, I've heard stories of this in all sorts of contexts, and Google actively push it for _all_ apps in the play console etc now. Carrying two devices just to use basic things will work, but god that sounds annoying.

I'm curious though, what are the more nefarious uses you're concerned about?

You'll have to change it often if you're worried about safety at all. Lineage has been keeping my phone alive for five years now, and although it only updates the upper layers and there are definitely unfixed vulns in the firmware, it's much better than if I'd used the stock OS that hasn't been updated since the beginning of 2020. Banks don't or won't understand this.

> Banks don't or won't understand this.

They are not interested in that. They want attestation because they can "outsource" the responsibility to Google.

> It's a total non-issue

Buying a separate device and carrying it all the time just for banking is a big ask for most people, even for geeks who hack their Android phones.

The problem is you need banking stuff on the go more and more. Here in Spain for example people often pay friends with a service called bizum that works through the bank's app.

It's definitely not a non issue for me.

Reply on news.ycombinator.com