Conversation

Notices

1. Embed this notice
   Andrew Zonenberg (azonenberg@ioc.exchange)'s status on Tuesday, 29-Jul-2025 03:08:29 JST Andrew Zonenberg

   • Rich Felker

   @becomethewaifu @dalias Mobile deposit is evil.

   My bank used to (until ~5 years ago) allow me to scan a paper check and upload front/back side jpegs through the website.

   There are exactly zero security features in a paper check that you can't trivially forge well enough to fool a phone camera. It makes no difference if the image is coming from a camera or a flatbed scanner or what. The numbers and amounts are what matters and they'll be reconciled with the sending bank when the check clears.

   I'm very tempted to get a dedicated phone just to do mobile deposits of the few checks a year I have to cash, so I don't have to ever install the app (and so I don't have to trust my banking credentials to my phone rather than the isolated VM I normally use)

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 29-Jul-2025 03:08:28 JST Rich Felker

     in reply to

     @azonenberg @becomethewaifu It's such a useless feature too. I deal with fewer than 5 checks per year, mainly from the IRS (sorry, I don't need DOGE having my banking info just to get paid a few months earlier) and occasionally from medical providers where I overpaid prior to insurance processing. There is utterly no reason I need my bank to police my phone for the sake of saving a trip to the bank (or an envelope and stamp to mail the check to the bank) for this bullshit.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 29-Jul-2025 03:11:20 JST Rich Felker

     in reply to

     @azonenberg @becomethewaifu The right way to deal with attestation hell, if it ever encompasses stuff you really "have to use", is with a dirt cheap used device left at home connected to your network running nothing but the offending app, and VNC from your real device.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 29-Jul-2025 03:13:00 JST Rich Felker

     in reply to

     @azonenberg @becomethewaifu I need to get a setup like that for WeChat. Last time I needed it I was unable to use it and all my accounts got banned for accessing from a non-vendor-locked-down phone. 🤬

   • Embed this notice
     Andrew Zonenberg (azonenberg@ioc.exchange)'s status on Tuesday, 29-Jul-2025 03:13:01 JST Andrew Zonenberg

     in reply to

     • Rich Felker

     @dalias @becomethewaifu That (minus the VNC) is what I do for WeChat already.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 29-Jul-2025 03:14:24 JST Rich Felker

     in reply to

     @azonenberg @becomethewaifu In the case of WeChat it's absolutely the app's fault. It does all kinds of invasive scanning of your device and either refuses to run, or pretends it's letting you run it then tattles so your account gets banned, if it sees root access, open source Android distros, certain apps that give the user extra control, etc. 🤬

   • Embed this notice
     Andrew Zonenberg (azonenberg@ioc.exchange)'s status on Tuesday, 29-Jul-2025 03:14:25 JST Andrew Zonenberg

     in reply to

     • Rich Felker

     @dalias @becomethewaifu (since all of my attempts to run either WeChat or Whatsapp or the other supported messengers in a VM or emulator resulted in pain... probably not the app's fault, just android being android)

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Tuesday, 29-Jul-2025 03:17:32 JST Rich Felker

     in reply to

     @azonenberg @becomethewaifu It's basically draconian fraud prevention. Because it's the "everything app" in China, it's a huge target for any type of fraud that affects any of the things it's used for, a lot of which involve significant amounts of money.

   • Embed this notice
     Andrew Zonenberg (azonenberg@ioc.exchange)'s status on Tuesday, 29-Jul-2025 03:17:33 JST Andrew Zonenberg

     in reply to

     • Rich Felker

     @dalias @becomethewaifu oh interesting.

     I assumed it was spyware but figured it was mostly just the PRC making sure you're not sharing rubber ducky gifs or something