I actually heard something about that in class not long ago
The story is that Android’s security heavily relies on the compartmentalization of apps that lives in the android layer, over the Linux kernel. Apparently, that functionality works in part because only this layer can perform operations that require root access, no app or user can. So software that allows you to root your phone apparently breaks this requirement, and makes the whole OS insecure. He even heavily implied that one should never root their phone with ‘free’ software found on the internet because that was usually a front for some nefarious shit regarding your data.
I’m just parroting a half-understood and half-remebered speech from a security expert. His credentials were impressive but I have no ability to judge that critically, if anyone knows more about this feel free to correct me.
Isn’t saying that allowing apps to have root lets them access anything just describing what root is? A rooted phone doesn’t have to give superuser access to every app.
No, but it can.
I think he was trying to say apps get access to “root features” through an abstraction layer/API calls that is controlled.
They don’t/wouldn’t have carte blanche root access to the underlying system. It’s kinda like a docker container or VM or flatpaks/snap packages on Linux. They are sandboxed from everything else and have to be given explicit premission to do certain things(anything that would need root privileges/hardware access).
I wouldn’t even feel compelled to root my phones if Google would actually back up my phone instead of whatever 1/4 baked shit they’ve done thus far.
I’ve been using android since 2010, and it’s gotten significantly better over the years. There’s only a few things it doesn’t back up, like text messages and app data, most of which you don’t need.
Mine backs up my text messages, but I would prefer to backup my app data, authenticators, wallpaper, themes, games, etc., not every app is a shitty front-end to a website.
It is not Android that is backing up most things though, it is mostly done by Google Services. That means that your data is effectively vendor locked-in if you want to use Android as an actual open source project. Google gutting the AOSP to this extent should be illegal (maybe even is, but might is right).
The problem is very simple - the majority of people are technically illiterate. Apple and Google saw the Windows XP security fiasco, looked at how many people use smart phones today and decided that giving users any rights is not worth the risk.
Because they want to “protect” you from “yourself”. Imagine, you could scrape your own data that you can already see.
I’d be really worried if the security of server operation for my bank depended on the client-side. But playing devils advocate, some people will most likely point out that a root exploit on a phone may be unintentional and used to spy on people, to which I answer:
- show me a big scary box where I can “accept the risk” and move on
- keep in mind that if I am root on my phone, I can hide the fact that I am root on my phone and you’ll be none the wiser
Currently, option 2 is in effect, sadly.
The issue with option one is that scammers get old (or not technical) people to do stuff when they don’t know what they’re doing and click the box not knowing what they just did. So yes very frequently they need to protect people from themselves because they’re dumb, but I still expect banks to do business with those dumb people, sooo… Option 2 it is.
Ok but also What tech illiterate person roots there phone
That’s where this part becomes relevant
a root exploit on a phone may be unintentional and used to spy on people
well you can buy a rooted phone that runs some thing like lineage preinstalled.
I think I just figured it out, hang on with me.
It’d be the tech literate person in the family. The nephew that’s working as a programmer or something like that. Now, if that nephew has some interest in stealing their uncles money, they now have access to their bank account through a freely rooted phone.
This gives them a lot of options, which I don’t have to explain.
Given that a lot of scams actually happen between presumed family and friends…
Yeah I kinda get why banks are doing this
Option 2 is not long for this world
As long as we’ll have control over the software, it’ll be there. If we reach the point were you’re not allowed to own computers, we’ll have bigger problem.
You deftly evaded the leading attack vector: social engineering. Root access means any app installed could potentially access sensitive banking. People really are sheep and need to be protected from themselves, in information security just like in anywhere else.
You don’t get a “accept the risk” button because people don’t actually take responsibility, or will click on those things without understanding the risk. Dunning Kruger at play.
Why is this prevalent on Android but not desktop Linux? Most likely a combination of 1) Google made it trivially easy to turn on, and 2) the market share of Android is significantly large enough to make it a problem warranting a solution.
The fact that you know how to circumvent it is inconsequential to the math above. Spoiler: you never were nor ever will be the demographic for these products, in their design, testing, and feature prioritisation.
Root access means any app installed could potentially access sensitive banking
That’s not how it work. Having a rooted phone does not turn it into a digital farwest were every application can do anything. It becomes a permission like everything else; if you only grant it to safe stuff (like, for example, not granting root to a single app but using it to customize your phone through ADB), there’s not much to see here.
In fact, it can be better: having root means you can arrange additional ‘firewalls’ between apps and your data , or omit/falsify sensor data the the banking app should not need, that the Google is unwilling to implement.
The word “potentially” was critical in the parent’s comment. A banking app cannot be assured that other apps are prevented from accessing its data when the phone is rooted.
So? If I, the customer, want to access my banking info, on my phone, with whatever means I want, I should be able to. As I said, it’s not like every app gets root access, if I, as the owner of the device, explicitly gave root access to something, it’s for a reason.
And the main point that a rooted phone can basically hide itself from any app remains; these “detections” are trivially bypassed in the exact situation they’re supposed to detect.
And if you don’t want to wear a mask on your face during a pandemic, you should be able to? Not everything is about you.
Banks practice defense in depth as other security practitioners do. Not every defense will stop every attack, so a layered, overlapping approach is used.
You really are missing the point that if the device is rooted there is nothing an app can do to protect itself. Defense in depth is layering (sometimes overlapping) solutions that do something. Detecting root and saying “nuh-uh” is not doing anything.
The reason is very simple: They rely on Google Safetynet (basically self-diagnosis). And that will immediately tell you off if it notices your device is rooted. And while you can have a lengthy discussion regarding whether this makes your phone less secure or not, this is another simple argument from Google’s POV: The device has obviously been tampered with, we don’t want to put any resources into covering this case. As far as we are concerned, you shouldn’t use our OS like this.
So basically laziness.
The banking apps I’ve tried don’t require SafetyNet, instead they use Android AOSP’s
basicIntegrity. The latter doesn’t require certification by Google, but also checks whether the device is rooted and the bootloader is locked.This means custom ROM’s on most devices won’t pass
basicIntegrity, as only Google Pixel,OnePlusand Fairphone allow for relocking the bootloader.
Does your bank have a Linux application? Of course not, you’re using the website. So why not use the website on your phone?
Most of the mobile sites I visited seemed to have only one goal, to get you to use the app and the mobile interface is often so bad that you’d better use the app
many banks require use of the app, regardless
And desktop mode doesn’t help?
i need to app for proprietary 2fa.
Ah. That’ll do it.
deleted by creator
If you don’t have a smart phone, how are you going to use a mobile website?
Why do I need to use a mobile website? I guess the comment I replied to was meaning they require their app for mobile banking vs browser which I should have realized
The comment is deleted now but it said something like “I’ll tell the bank I don’t have a smart phone so I can’t use the app” implying this would force the bank to allow them to use a mobile website.
What I misunderstood was what the bank required an app for, in my very sick and sleep deprived mind I thought they were saying banks required you to install their app to get service from that bank in any form which I thought was absurd, but that doesn’t seem to be the case.
Ohhhh, I see. Yeah, that is not the case anywhere I know of. Also, I hope you feel better soon tocopherol
Mobile web interfaces for banks are complete shit, and often can’t be circumvented.
Because as per usual they don’t understand security. I have started choosing my bank based on software they have. If software looks competent, that’s my most significant influence.
They think rooted device = insecure device, but at the same time PC is even less secure and yet all the business users use them and more to the point have passwords written on a sticky note glued to the screen. My old bank at one point “upgraded” their software system and then started asking me for weird characters in password and then asked for maximum length which was the final sin I allowed them to commit. Left them that week.
My bank keeps their app up to date with all the latest anti-root stuff but allows passwords made of 5 digits. ¯\_(ツ)_/¯
Unless they’ve changed it very recently, Paypal still limits your password to 20 characters
Unless they’ve changed it very recently, Wells Fargo’s passwords are case insensitive
Air Canada’s online account system required a 6 character password, which was secretly converted via T9 to 6 numbers on the back end, meaning “aaaaaa” and “bbbbbb” were effectively the same password, and this was only fixed in 2018
That sounds like someone who topped out with highschool level programming tried to implement a hash algorithm.
My personal theory is that it’s a remnant of an old system that was only accessible by phone (hence the 6 digit pin), and they simply grafted an online component on top of it
Any service that limits maximum length of the password means they are not hashing them. Which is a scary proposition, especially for such a huge service.
That’s normally my assumption too but surely PayPal has proper security, right? Right??
It’s possible that limit is either gone or vestige from a bygone age and they are hashing passwords properly now. Either way they do seem like they take security seriously.
Ah, that’s the “your problem” approach to security.
You’re better off with random different passwords for each service written on a sticky note than using the same password/email combofor multiple accounts.
I mean, you’re comparing very different scenarios.
If one account gets broken into and their password hashing was crap, the attacker can try the email/password combo with other services and can stumble onto another one you use.
If someone has access to your sticky note they have all your accounts.
I don’t think I’d call either of them better.
Of course, all this assumes no second auth factor.
If someone has access to your sticky note they’re already in your house, and that’s a bigger issue IMO… even from an itsec perspective, once the attacker has physical access to guarantee safety is difficult.
But seriously, there’s a guy in your house.
But seriously, there’s a guy in your house.
My house is not a prison… yes, other people come over. There’s the occasional party, handymen doing work, neighbors, parents of kids from school, kids sleeping over, and so on. It doesn’t have to be the ninjas breaking in.
If you don’t casually keep wads of cash in the open around the house you probably shouldn’t have logins on a post-it either. But to be fair the kind of person that does the latter does the former too.
If I know they are there then I either supervise visitors or trust them to not rummage/take my stuff. If that is your issue then keep your postit in a drawer; most people don’t keep their yubikeys in a securely bolted safe either.
Just shift the password descriptions a few spots compared to the passwords, then you’ll get email about failed logins as a canary.
Banks when you use browser 3 years of updates behind on Windows XP with multiple unpatched CPU vulnerabilities:
Old, insecure browsers are rejected too.
Google and Apple have been very successful at convincing everyone, including banks, to see the idea of users having control over their own phone-like computers as dangerous.
Next thing you know, banks will try to convince its clients that they really don’t need to access all their money.
It’s not just root. They would prefer you not to have a custom keyboard either.
That’s actually got a solid reason behind it.
It’s because the OSK is just another program as far as Android is concerned. It can’t directly look into the application, per Android specifications, but it CAN record key presses, even for passwords. It even receives context hints based on the metadata on the input box, so it knows when you’re putting in a password. Then it can send your data off to unknown servers.
thats a bit ironic seeing how the default keyboard on most phones are a privacy nightmare.
That it is, but at least it’s not sending your card details to me.
Yeah but why it’s sending details at all. There are FOSS options which are completely radio silent. Some password managers come with their own board.
I can’t believe I’m saying this, but thank God my country developers are incompetent.
I was greeted with this message:“This app can’t be used on a rooted device” And I was prepared to go through hoops to get it to work. you know, fucking safetynet and all. But it turns out that the solution was just enabling zygist on Magisk.
What does zygist do?
It’s just a technique that prevents selected apps from knowing that you have root access instead of just denying them the privileges.
Thank you!
Same, hiding root from my bank app was easy, no safetynet needed.
But their NFC phone payment was something else. I had to use safetynet and google play integrity fix with fingerprint that need to be renewed and other bullshit. I sent my phone in a boot loop too because the latest version had a bug for my specific phone …
I was disappointed they didn’t actually restrict the app for router devices.
yeah… in a way I was both happy and disappointed
You legend
Lmao, same.
I am both happy and slightly worried. Hapied?
Let’s be real here. Folks running Linux as thier desktop have a high chance of knowing what they are actually doing. Folks with rooted android phones have a high chance of having watched a 12 year old tell them how to root thier phone on TicTok. Which of these groups is participating in the more risky activity?
I never heard of someone rooting their phone due to a 12 year old on tiktok telling them to
To be fair, I jailbroke my iPhone 3GS when I was 13 because I saw someone do it on YouTube.
I’m not saying that they did it because a TikTok told them too, I’m saying its because that’s how a lot of the younger generation happens to search.
Just one example:
https://www.businessinsider.com/nearly-half-genz-use-tiktok-instagram-over-google-search-2022-7
I for one, would NOT trust some rando 30 second clickbait video telling me how to root my phone, but you can sure as shit bet that a ton of school aged children are doing that to play some cracked APK they got from a sketchy website because their parents wouldn’t buy them a 99c game.
Those same kids have bank and google pay apps setup on their phone so they can make purchases when they are out and about. I see kids using their phone for vending machine purchases ALL THE TIME.
Edit: Since this is a meme community, little bit of rage bait for ya: All the TikTokers coming out with the downvotes :)
No offense but you sound SO old lol. Tiktok isn’t just full of 12 year old’s and hasn’t been since, well, probably since covid started. With what a shit show standard search engines are these days I don’t blame them for searching what they know. There’s plenty of good info on tiktok that’s being presented by people that know their craft. The short format is nice too because it keeps them from telling their whole life story before they show me what I need to know.
The fact that you’re just basing your whole opinion here on an article kinda says it all really. I would have hoped my generation would outgrow this boomer bullshit but here we are.
Y’all are so worried about using things like Google pay but it’s going to become a standard whether you like it or not. It’s just another way to pay for shit and banks reimburse scammy bullshit just like they do if your card info gets stolen.
Nah, the article was something I went searching for after the fact. I guess “old” is in the eye of the beholder. My 8 year old thinks I’m old.
Just your bog standard Millennial here though. Started out with no tech growing up, and basically grew up along side and with the modern era of technology.
As for search engines, I agree, that’s why I use a selfhosted SearXNG instance. It’s not shoved down your throat google ads (much more akin to what google was 5 years ago or older), but TikTok surely isn’t the answer for “specialists in their field”, just like I wouldn’t have used Vine to source specialist knowledge before that. The problem with the format is there is to much “jumping to the end” without understanding why. You literally cannot get into the “why” in short video format, it’s a bit like “and now your draw the rest of the owl”.
I actually feel like some of the youngest generations while “perceived” to be technical because they grew up with tech actually lack much of the deeper understanding of how that same technology works. This is gonna sound very much “in my day we had to walk uphill both ways” kinda thing, but we did actually have to struggle with technology growing up. If you wanted it to work, you had to frequently do it yourself, and figure out why something wasn’t working with out reddit or online forums sourcing thousands of technical people. I use those skills to this day and it’s a skill I try and mentor into new hires at work.
I recall once early in my career, I caught a co-worker attempting to perform a change on a server for a Fortune 500 financial company using instructions on a webpage that looked like it was from a 1990’s Geocities website (this was probably 2012, so not sure where he even found it!). I slammed his workstation closed so fast and walked him into a conference room. Being “old” doesn’t mean out of touch, but it does often mean wiser.
Edit: Also, not sure where you got that I’m against google pay, venmo, paypal, square, amazon pay or any of those apps, I have them all installed on my phone. What I AM saying is that those apps are at risk to people who root their phones and install applications from sketchy sources. My point about kids using their phones at vending machines was to prove they are probably MORE at risk because they don’t understand the hows or whys to what they did when they rooted their phone and installed Minecraft (or any game!) from a sketchy crack page.
If any of the younger gens have a lack of understanding in tech then it’s on us. It’s on the older gens. We failed to guide them and push for the kind of education that they needed. Millennials, older millennials especially, were kind of privileged in this regard because we grew with the tech. We HAD to figure it out or just not interact with it. It’s not like we’re just built different or anything we just had different opportunities to learn. I don’t see how “watching a 30 second video by a 12 year old on tiktok” is realistically different from watching the video by a 12 year old typing in a notepad on YouTube that I used the first time I rooted a phone.
I swear every single generation makes things easier for the next and then immediately complains about “kids these days” and their lack of struggles
You may have missed where I specifically said I mentor new hires for those skills.
Stupid comment
Stupid reply
👍
This is the real problem.
Far too many people with rooted phones having no business with a rooted phone, installing whatever from wherever with no regard to the security implications.
At least people with root on a Linux system, by default, are going to be more knowledgeable in that regard.
12 year old tell them how to root thier phone on TicTok
The real pros learn from Indian guys on Youtube
Risky for who?
Can’t tell if this is serious question or not, but for the end user. Lemmy is a bit of a technical microcosm, so while we might not want protection from ourselves, the MAJORITY of people out there are not technically savvy. So while not everyone has a linux workstation (lets assume 2-3% based on some reporting) Android has an approximate 70% worldwide market share. So that means the VAST majority of people running Android probably can’t be trusted to plug in a toaster correctly. This is the same reason there are guiderails on roads with steep embankments.
Both parties.
The last time I rooted my phone, I used a sketchy app I downloaded from megaupload (man, I’m getting old) that may or may not have given that phone superherpes. You are not wrong.
see my reply to @pacoboyd@lemm.ee
maybe it’s just me, but isn’t it quite hard (at least for people not confident doing technical stuff) to root a phone?
like a decade ago the bootloader may have been unlocked by default and for many phones there were exploits so that they could be rooted with an app, but nowadays you would have to:
- unlock the bootloader by installing ADB and fastboot drivers, booting into download mode and run terminal commands that would reset your phone in the process; and for some phones, you would also need to shorten a test point and for quite a few of them nowadays, unlocking the bootloader is impossible
- boot into download mode and flash a custom recovery with fastboot or potentially with Odin or some other proprietary software (or sometimes you can root from download mode)
- for some newer (including Samsung) phones, you also need to disable dm-verity otherwise your phone wouldn’t be able to boot into Android
- boot into recovery mode and finally flash (probably Magisk) an image to root the system
I guess there are usually detailed instructions for this, but I doubt that most people rooting their phones now would be non-techie people who are just watching generic online tutorials. they would most likely stumble upon XDA or other forums that would have proper instructions. and even then, they are not very beginners friendly as they aren’t usually supposed to be followed by people with little to no experience with using the command-line, drivers, how Android phones work internally, etc.
Making my point for me. Those short form videos have very little chance of being right or accurate. They may have you going to some sketchy link and download and app that is supposed to do it for you etc etc.
My point is the people at risk don’t know they are participating in a risky activity. (not if they successfully rooted their phone or not).
ah, okay, that’s fair. in terms of short-form social media that tries to engage you, I’d expect little warning and for children especially to take more risks when encountering this type of content.
Folks with rooted android phones have a high chance of having watched a 12 year old tell them how to root their phone on TicTok.
I was more focused on this, though, because this sentence implied that you could successfully root your phone with short-form, likely phone-generic tutorials when the process nowadays is much more difficult and technical
But what about those of us who are running degoogled GrapheneOS.
I think you probably fall into that 3% I talked about in my other comment. I bet you know how to block apps from detecting root too, so probably not a good faith argument.
Btw, have you guys heard of Taler? It’s pretty interesting and I think you will be able to use it with a libre app
NGI TALER is a pilot funded by the European Commission and the Swiss State with the very concrete objective to roll out a new, best-in-class electronic payment system that benefits everyone: people, merchants, banks, financial authorities, auditors and anti-corruption researchers. The project doesn’t have to start from scratch either, but builds on the strong foundations of GNU Taler — the privacy-preserving digital payment system developed by the GNU community and Taler Systems SA with support from the NGI initiative. This offers privacy for those that make payments, while enforcing transparency on those that sell. By providing micro payments at very low overhead, GNU Taler permits internet business models to shift away from advertising revenue or subscription models, especially for online publishers. No-risk transactions can lower transaction fees and open online payments for the underbanked population and citizens marginalized from digitalisation.
I tried reading the website, but Im not really sure I get it. What it’s supoosed to be? A way how to make FIAT payments thats open-sourced and private (so you dont have to pay stupid fees to banks), and it integrates into the current banking system, or is it some kind of digital currency that’s not blockchain based?
If it’s the former - isnt any kind of payment without KYC almost impossible, since its heavily regulated? So, you can’t really have private payments in environment where there’s stupid amount of laws about how much you can actually pay without it being identifiable, for example the super small monthly limit on anonymous prepaid debit cards?
It’s not a currency - just a new payment system, but I don’t know how it works exactly. In order to make payments with it, your bank has to support it. Some banks are working on integrating it now. It’s supposed to be anonymous and the transaction history is supposed to be private. Currently only cryptocurrency has such features, but it looks like Taler will change that.
I played around with GNU Taler a while back. The payer is anonymous but verifiable (so I can’t pay with the same €3 ten times to ten people) but the recipient is known and the payment connected with the recipient, to satisfy avoiding tax evasion and fraud.
It still anticipates merchants taking some fee, but that fee should be able to be much less, as it doesn’t depend on Blockchain (requiring so much work) but is a suitable cryptographic algorithm so 3rd party merchants can compete.
Oh, I see. Oh well.
Can I send money to my friends with Taler? Taler supports push and pull payments between wallets (also known as peer-to-peer payments). While the payment appears to be directly between wallets, technically the operation is intermediated by the payment service provider which will typically be legally required to identify the recipient of the funds before allowing the transaction to complete.
Your bank already knows who you are, but with Taler you will be able to make payments using libre software and the bank won’t be able to track them. I guess if you send money to a friend, their bank will know they received the transaction, but won’t know who it was from. At least that’s my understanding.
It’s the banking equivalent of turning your device off for aircraft take off and landing.
If you keep doing stupid shit for long enough you can turn it into a religion. Huge profits will follow. It’s also why the unexamined life is no life at all.
bUt sEcuRiteeeEeeeEEE
There is no banking app for authenticating transactions for desktops?
Web browsers.
Edit: Nevermind, I don’t know what this even is.
At least in the EU web browsers don’t allow for authenticating transactions (beyond a limit of e.g. 30€). Either an additional authenticator app or a standalone card reader is mandatory.
Luckily my banking apps work flawlessly on GrapheneOS and even microG, likely because of they care about the bootloader being locked again.
I guess I don’t know what you mean by “authenticating transactions”.
Online transactions require a second factor which displays the actual amount to be transferred. This works by either an app which receives the transaction data (recipient, how much) over the network, or a device which takes the bank card and is used to scan something similar to a qr code. The device then displays the transaction data.
This makes sure a fraudulent site can’t easily change the amount or the recipient of a transaction, even if they somehow made an identical website (or close enough).
For remote transactions (e.g. online payments), the security requirements go even further, requiring a dynamic link to the amount of the transaction and the account of the payee, to further protect the user by minimising the risks in case of mistakes or fraudulent attacks.
https://www.ecb.europa.eu/press/intro/mip-online/2018/html/1803_revisedpsd.en.html
It’s not perfect, especially with people using a banking app and the second factor app on the same device for convenience sake.
Interesting. If they do that in the US some day, I would absolutely much rather buy that device than unroot my phone.
Not for authentication. No idea if this is not a thing, but banks here in Germany all have their weird proprietary TOTP app that checks if your device is rooted or now even if it is a “Google certified OS”.
You can use some weird hardware device instead with the obvious drawbacks.
My favorite thing is when banks don’t allow passwords that have spaces in them or are more than 12 characters long.
Honestly there should be a standard of what security means, like how passwords are stored and how TOTP is implemented, and if a bank doesn’t implement it then THEY are responsible for any “identity theft” that happens on their site, not the users.
Looking at you, fucking Paypal.
Or yes, my bank wanting only numbers not even letters.
Literally the only passwords I dont have in Firefox.
Your browser?
Rooted mobile devices are a reasonable signal they been have hacked and security features might be disabled or work as expected.
It just banks, a lot of corporate security polices don’t allow rooted devices, as they could bypass mobile device management policies for devices owned by the company.
With laptops it’s a different story. Whether users have Mac, Linux or Windows, there’s a reasonable chance they have admin access too, so checking for root access is not such a useful signal there.
Rooted mobile devices are a reasonable signal they been have hacked and security features might be disabled or work as expected.
Rooted mobile devices are a reasonable signal that someone wants to actually own what they buy, and corporations want to make sure as few people think that as possible.
Windows/Macos/Linux are designed around the fact that the person managing the device has root access, Android and iOS are designed around noone having root access.
Sure it’s fine to mess around with rooted phone and look what’s inside, but essentially for your daily operations having rooted phone is unnecessary security risk.
Android and iOS are designed around noone having root access.
Yes and I consider that to mean I don’t own the device. And there are plenty of Android forks specifically designed around you having root access.
The important question is why smartphones are designed around not having root access and computers are?
What are the incentives at play?
The answer is obvious, tech companies wouldn’t have given users access to root control on their computers either if they knew what they were doing and thought they could have gotten away with it.
It is just circular logic claiming smartphones have to be this way, circular logic that provides a rhetorical smokescreen for the process of corporations taking our agency away from us over our lives and the tools that sustain us.
The issue is that you don’t want to give some random untrusted process root access. You, the user, have root access as long as you’re capable of running processes as root, but that doesn’t mean you should.
There could be tons of apps on the iOS App Store or Google Play Store that are completely benign under the existing security model but do nefarious things when run as root. No one knows that for sure because they aren’t tested under root by Apple or Google.
The problem with root is that it’s giving the process the keys to the Ferrari. That’s long since been decided to be a bad security model. Far better to have the process request permission to access particular resources and you grant them on a case by case basis.
The issue is that you don’t want to give some random untrusted process root access.
It’s been awhile since I’ve used anything but Magisk but usually you have to set root permissions per app, or you can get Magisk notification to request access.
I just want to point out, that what you are saying sounds good in an ideal world. But the realitiy looks different. (I actually typed out some points, but then I remembered that I don’t want to engage in yet another lengthy internet-debate, that ultimately comes down to personal preferences and philosophy)
Ah but I love reading these specific philosophical discussions on tech, I don’t blame you though
You’re free to install another operating system or variation on Android on your phone still. And if you decided to go with another Android such as Graphene, you’d still not want to root it because it’s a security risk.
There’s also the fact that on Win/Mac/Linux, you’re interacting with the bank via a browser and not a bespoke app.
