Is there any point in preventing apps from running on rooted phones, if you also offer a web interface?

Question

Some banks prevent their apps from running on rooted phones, for alleged "security reasons".

However, you can usually use their services from the web interface anyway.

Using the same phone, having the same features.

Moreover, the web interface can, again, be accessed from any desktop computer, where every application have much more freedom than those on mobile phones.

So, under these circumstances, does it make any sense to prevent those apps to run, or it's just ignorance / superstition / you-name-it?

---

Please notice: under different circumstances, this might make sense. If, for instance, the web interface has less features than the app, or requires more authentications, or whatever.

This question, however, is only about situations where their features and authentications are more or less the same.

---

Example:

You’ll no longer be able to use our Mobile Banking app if we think the device you’re using has been jailbroken or rooted.

Jailbreaking and rooting, removes safeguards from your phone which can leave your device vulnerable to fraudulent attacks.

You’ll still be able to access Mobile Banking through your mobile browser – visit {site} from your mobile phone and sign in.

---

WARNING! This is not a rant. If you are not happy with your bank's policy, just switch to a different bank, it's easy.

This is simply a genuine question, i.e. I'm wondering if there is anything I'm missing.

If you think this is a rant, it either means I didn't write well enough, or that you didn't read carefully enough, or a mixture of both. But rest assured it's not intended to be.

Answer 1

A rooted phone may allow the user to install services that are able to read the private data of other apps. Many online banking apps rely on app-private storage for their easy sign-on system. (i.e. 4 digit PIN or Fingerprint)

If the bank cannot rely on app-private storage, then a more thorough authentication is required (i.e. full password and possible security question), as you would normally see in the web-based interface.

Furthermore, the app may store additional cached information in the app-private storage for a better user experience, knowing that app-private storage is more secure than browser localStorage.

If app-private storage is compromised then these assumptions cannot be relied upon.

Personally, I think that this is a bit of an over-reach for the bank. It is just really annoying for the tech-savvy users who are careful about installing root-capable apps.

Perhaps some (non-tech-savvy) users (who don't understand the risk of rooted devices) will benefit. The risk of having your online banking account hijacked is quite serious.

Most of the (possible) risks of using a rooted phone (i.e. screen-scrapers and keyloggers) still apply when using the browser online version.

Answer 2

Native Apps installed as a package on smartphones might have significant difference from their web interface. They may sometimes be talking to a different API to get the content. To make the application usage smoother, they might also be caching some data.

As you said, the risk from above are applicable to web applications running on a laptop machine as well. The major concern here might be about the SSL implementation. In a web application, applications rely on the certificate store of the browser. Android devices on the other hand relies on the trusted credentials store of the mobile device. Android applications also use an additional security feature - SSL pinning - to ignore the device's trusted credentials and to rely on it's own custom security credentials. This ideally would save the user from a MITM attack even if one of the certificates in the device is compromised. However rooted phones can be used to bypass SSL pinning. So malwares running on a rooted phone will have full access to your HTTPS communication even if your bank application is using SSL pinning. The bank warning must be a way to avoid risks from that perspective.