Author Topic: OS must verify your age before use  (Read 9225 times)

0 Members and 1 Guest are viewing this topic.

Offline paulca

  • Super Contributor
  • ***
  • Posts: 6009
  • Country: gb
Re: OS must verify your age before use
« Reply #125 on: May 05, 2026, 11:51:51 am »
The other way to look at this is the reality.

If Google/Apple were not vetting those apps and if Google/Apple were not actively ensuring their OS safety there would be NO online banking apps.

The only reason they exist at all is because Google and Apple present a security enough platform for them to exist.

Try running your banking app on GrapheneOS and see how far you get.
"What could possibly go wrong?"
Current Open Projects:  STM32F411RE+ESP32+TFT for home IoT (NoT) projects.  Child's advent xmas countdown toy.  Digital audio routing board.
 

Online SiliconWizard

  • Super Contributor
  • ***
  • Posts: 17529
  • Country: fr
Re: OS must verify your age before use
« Reply #126 on: May 05, 2026, 05:05:04 pm »
Most banks still allow you to access your accounts via just a web browser, but many have restrictions for some operations that still require using a mobile app to at least validate (or else you have to go to your bank in person). The reason is that there is biometric authentication via mobile devices (fingerprint or face recognition), while there is no such thing, as of yet, on web browsers on a desktop OS. At least not anything that is recognized as secure enough. Now that's usually only required for more critical operations, such as anything that would require signing a new contract, or transfering a large amount of money, so it's not necessary in your day-to-day life.

 

Offline Someone

  • Super Contributor
  • ***
  • Posts: 5972
  • Country: au
    • send complaints here
Re: OS must verify your age before use
« Reply #127 on: May 05, 2026, 11:06:46 pm »
The reason is that there is biometric authentication via mobile devices (fingerprint or face recognition), while there is no such thing, as of yet, on web browsers on a desktop OS. At least not anything that is recognized as secure enough.
Over here in Aus all the banking apps I'm aware of do not require any of that additional security on the device, as they will install and operate happily on devices that lack those features (but still run the same OS).

Some (banking) 2FA apps are just a giant window dressing around a standard TOTP, branded (or not for those that just ask you to use Symantec VIP). What they really care about it not being able to clone/copy/backup the authentication keys which is entirely at odds with what the user wants (do you only have a single house key with zero backups ?).

But soldar is correct that there are neo/"new" banks that don't even have a website and only want to go through an app. To "compete" with that traditional banks are moving some of their products/features to app only. As discussed this is a business choice (reaffirmed by our consumer protection bodies as not discrimination) and businesses will do whatever they like. However, citizens access to government services is generally protected. But for example Australian government(s) are also moving away from fair access with some of their online platforms only being accessible if you have their companion app(s) either for authentication, or app only content....

lols when the "app only" content was clearly just a html rendered page that they would only serve to their app (99% of that app being just sandboxed web browser, used as presentation and most internal navigation).

To choose to use a bank which only offers access via dedicated smartphone app is exactly that, a personal choice, and also a choice by said bank as to how it wishes to deliver it services.  I fail to see how it constitutes 'monopoly power' being exerted by Google.
Why are you forcing together two individual clauses that soldar clearly isn't? Requiring citizens to have either a google or apple store account and a supported device, just to access services they are already entitled to seems like monopoly level stuff to me.

Australia had this when the only way to complete your taxes was either paper forms, paying a professional to submit the data on your behalf, or.. using a windows program:
https://appdb.winehq.org/objectManager.php?sClass=application&iId=1123
the official answer, you have to buy windows! but the government will pay you back for that expense:
https://www.theregister.com/2012/07/24/ato_virtualisation_deductions/
But that was back when there was a paper/in-person option still available.
 
The following users thanked this post: TUMEMBER

Offline Someone

  • Super Contributor
  • ***
  • Posts: 5972
  • Country: au
    • send complaints here
Re: OS must verify your age before use
« Reply #128 on: May 05, 2026, 11:09:46 pm »
If Google/Apple were not vetting those apps and if Google/Apple were not actively ensuring their OS safety there would be NO online banking apps.
I think the question is rightly: what can an app do that a webpage cant? ... that is of benefit/interest to the customer.

Push notifications? No thanks.
Storing the access keys where I cant get to them? No thanks.
 

Offline default0.0player

  • Regular Contributor
  • *
  • Posts: 77
  • Country: cn
Re: OS must verify your age before use
« Reply #129 on: May 06, 2026, 04:31:13 am »
The other way to look at this is the reality.

If Google/Apple were not vetting those apps and if Google/Apple were not actively ensuring their OS safety there would be NO online banking apps.

The only reason they exist at all is because Google and Apple present a security enough platform for them to exist.

Try running your banking app on GrapheneOS and see how far you get.
It's never about security, it's always about control. There's nothing physically prevent these banking apps from running on degoogled phones. However there's collusion/conflict of interest that made between google/apple and these banks so that those banking apps won't run on other ROMs or modified systems. There are ways to bypass it, it's hard but not impossible
 
The following users thanked this post: TUMEMBER

Offline soldar

  • Super Contributor
  • ***
  • Posts: 4035
  • Country: es
Re: OS must verify your age before use
« Reply #130 on: May 06, 2026, 04:27:43 pm »
The other way to look at this is the reality.

If Google/Apple were not vetting those apps and if Google/Apple were not actively ensuring their OS safety there would be NO online banking apps.

The only reason they exist at all is because Google and Apple present a security enough platform for them to exist.

Try running your banking app on GrapheneOS and see how far you get.

I disagree strongly and your point does not address my point.

First, If you could download the App directly from your bank there is no obstacle in the bank ensuring its security and they could use anyone they wanted, including Google for that purpose. Same as you can download programs to your computer.

But my point is that even if you download it from Google you should not be required to have a Google account. I do not wish Google to have so much info on me.
All my posts are made with 100% recycled electrons and bare traces of grey matter.
 

Offline soldar

  • Super Contributor
  • ***
  • Posts: 4035
  • Country: es
Re: OS must verify your age before use
« Reply #131 on: May 06, 2026, 04:31:30 pm »
May it please the Court:

I propose that the requirement for phone apps to be downloaded necessarily from Google or Apple, should be prohibited in the EU based on the following grounds:

1- It gives Google excessive and unjustified information of individuals and this contravenes the right to privacy.

2- It ties in a product which the consumer wants (example a bank account but can be anything) with a product the consumer may not want (a Google account). Tying-in has long been considered an anticompetitive practice and often declared illegal. See note below.

3- Users in the EU depend on a foreign company, in this case a USA company (Google) and the company or the government of that country could stop or block the functioning of their services in the EU which would be catastrophic for the daily life and functioning in the EU. This is in fact a yield of sovereignty to the USA which should not be allowed.

Much of the same can be said about American Credit card payment services, especially #3 and #1.

Based on these points I believe the EU should take steps to counter all three of them. For starters and effective immediately Google should be forced to allow the download in the EU of apps without the need to have a Google account.

Next the EU should ensure Google operates in the EU with offices and servers in the EU which can be adequately and effectively controlled by the EU authorities. Probably require Google set up a European subsidiary very tightly controlled.

The EU should not cede sovereignty like this. Apps, banking, payments, etc should be tightly controlled by the EU and not by the USA.

China and Russia have their own systems and the EU should too. We need to stop being an American underage colony.

Of course, it won't happen. EU leaders are useless, not fit for purpose and corrupt as can be.





AI:

Linking the purchase of products—often referred to as tying—is considered an anti-competitive practice when a seller with significant market power forces buyers to purchase an unwanted product (the "tied" product) as a condition of acquiring a desired product (the "tying" product).

This practice is scrutinized under antitrust laws because it can harm competition by limiting consumer choice and preventing competitors from entering the market for the tied product.

Key Elements of Anticompetitive Tying

For a tying arrangement to be deemed illegal, it often requires the following elements:

- Two Separate Products: The tied and tying items must be distinct products, not just components of a single item.
- Coercion: The seller forces the buyer to take the second product, rather than offering it as an optional bundle.
- Market Power: The seller holds significant, dominant power in the market for the tying (first) product.

Examples of Anticompetitive Behavior

Software and Hardware: Requiring that an operating system only be purchased with a specific web browser (e.g., United States v. Microsoft).
Medical Equipment: A manufacturer of a specialized, patented machine forcing hospitals to buy their, and only their, disposable consumables.
Services: A lender making a loan conditional on the borrower purchasing insurance from a subsidiary (a violation of the Bank Holding Company Act).

« Last Edit: May 07, 2026, 11:46:35 am by soldar »
All my posts are made with 100% recycled electrons and bare traces of grey matter.
 
The following users thanked this post: spostma, TUMEMBER

Online Cyclotron

  • Supporter
  • ****
  • Posts: 1676
  • Country: us
  • *POOF*
Re: OS must verify your age before use
« Reply #132 on: June 16, 2026, 09:42:23 pm »
Looks like California is considering an exemption for open source.  But don't they know android is open source?

https://www.eff.org/deeplinks/2026/05/one-step-forward-two-steps-back-cas-ab-1856-exempts-open-source-expands-age-gating
 

Offline Marco

  • Super Contributor
  • ***
  • Posts: 7730
  • Country: nl
Re: OS must verify your age before use
« Reply #133 on: June 16, 2026, 10:01:48 pm »
It's never about security, it's always about control.

My bank very early in the internet banking days used dedicated hardware to sign transactions (and verify them, though only for single transactions) while most banks were using one time use codes or SMS. I think the security guarantees of Google/Apple do play a role in them giving the app leeway to be authoritative.

Security which say Graphene can't offer. Graphene own the keys to the universal backdoor on Graphene phones and they just don't have the same economic incentive and power to protect it as Google/Apple.
« Last Edit: June 16, 2026, 10:03:19 pm by Marco »
 

Offline u666sa

  • Frequent Contributor
  • **
  • Posts: 791
  • Country: us
  • Miami, FL
    • Codernov Electronics Repair
Re: OS must verify your age before use
« Reply #134 on: June 17, 2026, 12:54:22 am »
I cannot see how it could be enforced. How can they prevent anyone from installing any OS?
They can't.

This is political signaling more than anything else. The goal is not to pass a workable law. The goal is to make headlines, signal “I’m protecting kids”, pressure tech companies, establish a bargaining position, appeal to parents who don’t understand the tech. These bills are often written to be maximally dramatic, knowing full well that they will be struck down, watered down, amended beyond recognition and never enforced. The headline is the point.

This is exactly how the UK’s “Age Appropriate Design Code” started — extreme drafts, then a much narrower final law.
 

Offline u666sa

  • Frequent Contributor
  • **
  • Posts: 791
  • Country: us
  • Miami, FL
    • Codernov Electronics Repair
Re: OS must verify your age before use
« Reply #135 on: June 17, 2026, 12:59:08 am »
It's already started. "MidnightBSD Responds to California's Age Verification Law by Excluding California"
Small OS projects don’t have legal teams or resources, so they block California entirely. Midnight BSD is doing what everyone else will do, except Microsoft and Apple and maybe some corporate service Linuxes.
 

Offline paulca

  • Super Contributor
  • ***
  • Posts: 6009
  • Country: gb
Re: OS must verify your age before use
« Reply #136 on: June 17, 2026, 07:26:20 am »
This is exactly how the UK’s “Age Appropriate Design Code” started — extreme drafts, then a much narrower final law.

Have you been paying attention?  The UK law works the other way.  They introduce a small part wait for the public outcry to quieten down, then they start adding the "Amendments" the OSA has had about 3 or 4 tightenings so far and more are coming.
"What could possibly go wrong?"
Current Open Projects:  STM32F411RE+ESP32+TFT for home IoT (NoT) projects.  Child's advent xmas countdown toy.  Digital audio routing board.
 

Offline tom66

  • Super Contributor
  • ***
  • Posts: 8588
  • Country: gb
  • Professional HW / FPGA / Embedded Engr. & Hobbyist
Re: OS must verify your age before use
« Reply #137 on: June 17, 2026, 10:36:35 am »
If Google/Apple were not vetting those apps and if Google/Apple were not actively ensuring their OS safety there would be NO online banking apps.
I think the question is rightly: what can an app do that a webpage cant? ... that is of benefit/interest to the customer.

Push notifications? No thanks.
Storing the access keys where I cant get to them? No thanks.

There's lot of things that webpages can't do that would be important for a banking app:
- Access touch ID/face ID/etc.
- Store large files on the phone, e.g. encryption keys.
- Verify against custom CAs.
- Prevent screenshots & key/touch capture.

They're also generally slower than native applications because they require JavaScript, and they require a continuous network connection for downloading resources, whereas the mobile app just needs to download e.g. account balance & transactions.

 

Offline Someone

  • Super Contributor
  • ***
  • Posts: 5972
  • Country: au
    • send complaints here
Re: OS must verify your age before use
« Reply #138 on: June 17, 2026, 11:32:27 am »
If Google/Apple were not vetting those apps and if Google/Apple were not actively ensuring their OS safety there would be NO online banking apps.
I think the question is rightly: what can an app do that a webpage cant? ... that is of benefit/interest to the customer.

Push notifications? No thanks.
Storing the access keys where I cant get to them? No thanks.
There's lot of things that webpages can't do that would be important for a banking app:
- Access touch ID/face ID/etc.
- Store large files on the phone, e.g. encryption keys.
- Verify against custom CAs.
- Prevent screenshots & key/touch capture.

They're also generally slower than native applications because they require JavaScript, and they require a continuous network connection for downloading resources, whereas the mobile app just needs to download e.g. account balance & transactions.
They could do those things, but as above I'm not aware of any that require biometric resources. Current support for browser based biometric (enforced) authentication is mature:
https://en.wikipedia.org/wiki/WebAuthn

Encryption keys should not be large files and the encapsulation of them is exactly what I'm saying is anti-consumer. Oh you lost your phone or it was reset? you'll need to setup all your identity again from scratch from primary documents run through validation as we only let you have one key instance at a time which cannot be backed up, reality of what has and does occur.

Preventing screenshots and key interception is mostly security theatre and gets in the way of useful things like accessibility (screen readers or alternative keyboard entry) or password managers. Oh boy does that one grate me the wrong way, "please enter your password": ...  on our custom keyboard looking thing which has completely different layout and operation to the OS default. We got the scaling wrong and keys are too small to hit with the touch API (which isn't using prediction and dynamic sizing for touch input like the OS native key entry) oh well whatever you don't have any other choice.

Banks have been notoriously bad at digital authentication:
https://security.stackexchange.com/questions/266608/should-a-bank-be-able-to-shorten-your-password-without-your-involvement
https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/
Locking people out because their end changes the password silently!

Part of the issue of apps is they are (google and apple "stores") distributed through the narrow channel and not available for older devices, oh you cant login until you update your 400MB "app" to get access (real example of a fintech app that has little user function so your claims of data saving are not guaranteed). Not available for that OS you have, no access for you. Sure it's a convenient cost saving for the developers to reduce the testing scope, but we have very widely supported web standards, and from my experience bugs are just as common either way.
 

Offline paulca

  • Super Contributor
  • ***
  • Posts: 6009
  • Country: gb
Re: OS must verify your age before use
« Reply #139 on: June 17, 2026, 11:45:15 am »
Preventing screenshots and key interception is mostly security theatre and gets in the way of useful things like accessibility (screen readers or alternative keyboard entry) or password managers.

.. and screenshare utilities whether you know they are install or not.  Also remote access systems like "TeamViewer" which exist on mobile phone and are routinely used by scammers to hijack people's computers and logged in online banking sessions.

The phone OS having a secure and validated way of reporting such activity and the banking apps being able to immediately log the user out, prevents that entire genre of scam functioning on mobile devices.
"What could possibly go wrong?"
Current Open Projects:  STM32F411RE+ESP32+TFT for home IoT (NoT) projects.  Child's advent xmas countdown toy.  Digital audio routing board.
 

Offline tom66

  • Super Contributor
  • ***
  • Posts: 8588
  • Country: gb
  • Professional HW / FPGA / Embedded Engr. & Hobbyist
Re: OS must verify your age before use
« Reply #140 on: June 17, 2026, 01:09:23 pm »
Android and iOS both allow the keyboard "app" to be replaced, which is why some of these banking apps insist on using a custom keyboard as a malicious keyboard could intercept passwords and PINs.  The better apps force the OS keyboard.  There's currently no web API that can say "only accept OS keyboard" as far as I know.

And you can still record the screen unless screenshare permission is forbidden which would allow key presses to be read (you can see the keys change/highlight).

You can't block custom keyboards via web apps and you can't stop screenshots, so web apps for banking are always going to be less secure than native, and slower. 
 

Offline Messtechniker

  • Frequent Contributor
  • **
  • Posts: 907
  • Country: de
  • Old analog audio hand - No voodoo.
Re: OS must verify your age before use
« Reply #141 on: June 17, 2026, 07:03:49 pm »
Mom simply hands her fully unlocked mobile to her kid(s).
Seen this with kid at the age of 3! Foget about age lock.
Agilent 34465A, Siglent SDG 2042X, Hameg HMO1022, R&S HMC 8043, Peaktech 2025A, Voltcraft VC 940, M-Audio Audiophile 192, R&S Psophometer UPGR, 3 Transistor Testers, DL4JAL Transistor Curve Tracer, UT622E LCR meter, UT216C AC/DC Clamp Meter
 

Offline Someone

  • Super Contributor
  • ***
  • Posts: 5972
  • Country: au
    • send complaints here
Re: OS must verify your age before use
« Reply #142 on: June 17, 2026, 10:51:21 pm »
Preventing screenshots and key interception is mostly security theatre and gets in the way of useful things like accessibility (screen readers or alternative keyboard entry) or password managers.
.. and screenshare utilities whether you know they are install or not.  Also remote access systems like "TeamViewer" which exist on mobile phone and are routinely used by scammers to hijack people's computers and logged in online banking sessions.

The phone OS having a secure and validated way of reporting such activity and the banking apps being able to immediately log the user out, prevents that entire genre of scam functioning on mobile devices.
Relying on the OS to enforce no screen sharing by [app choice] is just the same level of confidence as relying on the OS to protect against no screen sharing by [user choice]. Preventing screenshots by the OS is also not the same level of risk.
 

Offline Someone

  • Super Contributor
  • ***
  • Posts: 5972
  • Country: au
    • send complaints here
Re: OS must verify your age before use
« Reply #143 on: June 17, 2026, 11:07:11 pm »
You can't block custom keyboards via web apps and you can't stop screenshots, so web apps for banking are always going to be less secure than native, and slower.
sure, you can walk it off into the "perfect" security system (below). I'm saying blocking screen shots (as distinct from screen sharing) is the sort of anti consumer thing that apps encourage/make-easy and why those sorts of apps are a crap way to interact with things that are routinely done via a website... often with the same provider/service.

Adding app only features that are not at all related to the difference in capabilities/functionality between an app and a website....  anti-consumer.

Look at things like the PayPal app which they push aggressively. No additional features or functionality over the website (perhaps some security advantage) but in return they want access to your browser history, exact location, etc. "just" a 465MB app.

Or a bank offering their 2FA TOPT app, just a TOPT, 160MB and updates every few months, does not support a 3 year old device. A trivial feature which other services let you choose your own tool for instead some upgrade forcing crapware. For a possible sliver of security improvement.
 

Offline default0.0player

  • Regular Contributor
  • *
  • Posts: 77
  • Country: cn
Re: OS must verify your age before use
« Reply #144 on: June 18, 2026, 02:52:10 am »
This is exactly how the UK’s “Age Appropriate Design Code” started — extreme drafts, then a much narrower final law.

Have you been paying attention?  The UK law works the other way.  They introduce a small part wait for the public outcry to quieten down, then they start adding the "Amendments" the OSA has had about 3 or 4 tightenings so far and more are coming.
There's more https://reclaimthenet.org/uk-wants-message-scanning-on-phones. Full client side scanning, turning smartphones into telescreens.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf