Monzo app upgrade

Shakin_Steve

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

friolento said:

Chief_of_Staffy said:

Tens of millions of people in the UK use apps on a wide range of hardware and firmware, and have done for many years. That's usage into the multiple trillions of occasions. Find me one instance of a customer, in the absence of negligence or complicity, having their account compromised because they were running the app on 'outdated' technology. Just one.

That would be hard to do because the providers of the apps will ensure that the supported versions of their apps only run on currently supported version(s) of the platform. This to protect their customers from inadvertently (or advertently) exposing themselves to security vulnerabilities.

Claimed vulnerabilities exist practically from OS release day. Yet there is essentially zero evidence that these vulnerabilities translate to real world risk. Even the security researchers, whose livelihoods depend on inflating the risk, have nothing to offer in this department. It's basically the same story as we're told with MS Windows. You must install all security patches because otherwise a hacker will take over your PC! It simply doesn't happen.

What do you suggest they do instead? Keep quiet when they find a security flaw, never fix anything they find and trust that nobody else will ever find the same flaw? 

I refer you back to my point about 'security flaws'. If someone demonstrates that they are a relevant risk then I might change my mind.

You didn't answer my question, what approach would you be happy with them taking?

If they never fixed anything and someone became a victim as a result you'd be saying that they show contempt for customers by not taking security seriously and putting profit first by not spending money on fixing things. 

I did answer the question, because I said twice now that I know of not one single case where a person 'became a victim as a result' of running apps on allegedly outdated OS. Given that there is no evidence of a security risk, why should I recommend they take any steps to mitigate it, let alone steps that making banking very expensive, very complicated and, for some people, impossible.

Maybe there are no instances of anyone becoming a victim of fraud because apps won't run on an outdated OS. No access equals no chance of fraud.

Chief_of_Staffy

Shakin_Steve said:

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

friolento said:

Chief_of_Staffy said:

Tens of millions of people in the UK use apps on a wide range of hardware and firmware, and have done for many years. That's usage into the multiple trillions of occasions. Find me one instance of a customer, in the absence of negligence or complicity, having their account compromised because they were running the app on 'outdated' technology. Just one.

That would be hard to do because the providers of the apps will ensure that the supported versions of their apps only run on currently supported version(s) of the platform. This to protect their customers from inadvertently (or advertently) exposing themselves to security vulnerabilities.

Claimed vulnerabilities exist practically from OS release day. Yet there is essentially zero evidence that these vulnerabilities translate to real world risk. Even the security researchers, whose livelihoods depend on inflating the risk, have nothing to offer in this department. It's basically the same story as we're told with MS Windows. You must install all security patches because otherwise a hacker will take over your PC! It simply doesn't happen.

What do you suggest they do instead? Keep quiet when they find a security flaw, never fix anything they find and trust that nobody else will ever find the same flaw? 

I refer you back to my point about 'security flaws'. If someone demonstrates that they are a relevant risk then I might change my mind.

You didn't answer my question, what approach would you be happy with them taking?

If they never fixed anything and someone became a victim as a result you'd be saying that they show contempt for customers by not taking security seriously and putting profit first by not spending money on fixing things. 

I did answer the question, because I said twice now that I know of not one single case where a person 'became a victim as a result' of running apps on allegedly outdated OS. Given that there is no evidence of a security risk, why should I recommend they take any steps to mitigate it, let alone steps that making banking very expensive, very complicated and, for some people, impossible.

Maybe there are no instances of anyone becoming a victim of fraud because apps won't run on an outdated OS. No access equals no chance of fraud.

In other words, an evidence-free approach. Convenient for the banks, the app coders and sellers, the phone manufacturers, pretty much everyone but the customer.

Rob5342

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

friolento said:

Chief_of_Staffy said:

Tens of millions of people in the UK use apps on a wide range of hardware and firmware, and have done for many years. That's usage into the multiple trillions of occasions. Find me one instance of a customer, in the absence of negligence or complicity, having their account compromised because they were running the app on 'outdated' technology. Just one.

That would be hard to do because the providers of the apps will ensure that the supported versions of their apps only run on currently supported version(s) of the platform. This to protect their customers from inadvertently (or advertently) exposing themselves to security vulnerabilities.

Claimed vulnerabilities exist practically from OS release day. Yet there is essentially zero evidence that these vulnerabilities translate to real world risk. Even the security researchers, whose livelihoods depend on inflating the risk, have nothing to offer in this department. It's basically the same story as we're told with MS Windows. You must install all security patches because otherwise a hacker will take over your PC! It simply doesn't happen.

What do you suggest they do instead? Keep quiet when they find a security flaw, never fix anything they find and trust that nobody else will ever find the same flaw? 

I refer you back to my point about 'security flaws'. If someone demonstrates that they are a relevant risk then I might change my mind.

You didn't answer my question, what approach would you be happy with them taking?

If they never fixed anything and someone became a victim as a result you'd be saying that they show contempt for customers by not taking security seriously and putting profit first by not spending money on fixing things. 

I did answer the question, because I said twice now that I know of not one single case where a person 'became a victim as a result' of running apps on allegedly outdated OS. Given that there is no evidence of a security risk, why should I recommend they take any steps to mitigate it, let alone steps that making banking very expensive, very complicated and, for some people, impossible.

You didn't answer the question because you didn't state what you would like the os and phone vendors and the banks that do instead. 

Chief_of_Staffy

Rob5342 said:

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

Rob5342 said:

Chief_of_Staffy said:

friolento said:

Chief_of_Staffy said:

Tens of millions of people in the UK use apps on a wide range of hardware and firmware, and have done for many years. That's usage into the multiple trillions of occasions. Find me one instance of a customer, in the absence of negligence or complicity, having their account compromised because they were running the app on 'outdated' technology. Just one.

That would be hard to do because the providers of the apps will ensure that the supported versions of their apps only run on currently supported version(s) of the platform. This to protect their customers from inadvertently (or advertently) exposing themselves to security vulnerabilities.

Claimed vulnerabilities exist practically from OS release day. Yet there is essentially zero evidence that these vulnerabilities translate to real world risk. Even the security researchers, whose livelihoods depend on inflating the risk, have nothing to offer in this department. It's basically the same story as we're told with MS Windows. You must install all security patches because otherwise a hacker will take over your PC! It simply doesn't happen.

What do you suggest they do instead? Keep quiet when they find a security flaw, never fix anything they find and trust that nobody else will ever find the same flaw? 

I refer you back to my point about 'security flaws'. If someone demonstrates that they are a relevant risk then I might change my mind.

You didn't answer my question, what approach would you be happy with them taking?

If they never fixed anything and someone became a victim as a result you'd be saying that they show contempt for customers by not taking security seriously and putting profit first by not spending money on fixing things. 

I did answer the question, because I said twice now that I know of not one single case where a person 'became a victim as a result' of running apps on allegedly outdated OS. Given that there is no evidence of a security risk, why should I recommend they take any steps to mitigate it, let alone steps that making banking very expensive, very complicated and, for some people, impossible.

You didn't answer the question because you didn't state what you would like the os and phone vendors and the banks that do instead. 

That is the answer to the question.

Chief_of_Staffy said:

Given that there is no evidence of a security risk, why should I recommend they take any steps to mitigate it

Rob5342

You aren't saying what they should do instead l, so its a response saying you aren't going to engage, an answer that the question.

I doubt we'll get any further with this so I'll just leave it there. 

Chief_of_Staffy

Rob5342 said:

You aren't saying what they should do instead l, so its a response saying you aren't going to engage, an answer that the question.

You keep asking what will they do instead of doing something that is not necessary. If someone doesn't do something that is not necessary then there's no requirement to replace the intended action with any other. If you rush to lock your car and realise it's already locked, you don't stand there in the middle of the street saying, "What do I instead of locking my car?" You just don't do it.