Comment

Comment on Bypassing problematic captive portals. Cafe gave me a red padlock; transit svc has broken TLS captive portal, etc…

x3i@kbin.social ⁨7⁩ ⁨months⁩ ago

Whenever you accept the TOS, your device is somehow registered/authenticated against their servers. Such a session establishment of course should be secured through TLS, just like all web traffic in general. Frankly, I see the issue here clearly on your side; you have to make sure your device supports up-to-date cryptography standards.

I saw in a different comment that you do not want to replace your phone but you definitely have to replace your software. Find an older build of lineageOS (well, probably even CyanogenMod in this case) and migrate to that. Even if it is based on Android 8, it would still be much more in line with modern security than what you are running now.
Btw, the complaint of you not being able to do banking through your browser anymore while it does not support TLS 1.3 really made me laugh, thank you!

I don't think you realize just how big the risk is that you are putting yourself in with such old software.

source

Sort:hotnew top

coffeeClean@infosec.pub ⁨7⁩ ⁨months⁩ ago
Btw, the complaint of you not being able to do banking through your browser anymore while it does not support TLS 1.3 really made me laugh, thank you!

You’re confusing different situations. The TLS 1.3 issue has nothing to do with the bank. Desktop computers are not trapped on old software. Androids are. The bank requires customers to:

buy a smartphone (because the bank’s app detects when it is running on an Android emulator)

subscribe to mobile phone service (which requires showing national ID to the mobile carrier)

share their mobile phone number with a power abusing surveillance capitalist who promotes the oil industry (Google / Totaal)

create a Google account and agree to their terms (which includes not sharing software that was fetched from the Playstore jail)

share their IMEI# with Google

install proprietary non-free software and trust the security of non-reviewable code

I don’t think you realize just how big the risk is that you are putting yourself in with such old software.

You don’t seem to realize Android phones are designed for obsolescence and desktop PCs are not. The elimination of web access ensures users will be accessing their accounts with older software. Why would you endorse that? Not sure you realize that using an Android emulator ensures the ability to constantly run bleeding edge updated software. But the bank won’t have it. You also overestimate the security of code you cannot see to satisfy your threat model. How do you know the bank itself does not have spyware in their app? Of course they do. They want to KYC.
source