Yeah, because not only is it viable, they absolutely never get blocked! lol

It's so fucking easy to do so. Even run it off a rented host.

Cannot confirm, somewhat. Setting it up so you don't get blocked is rather easy, figuring out how to do that correctly is a bit of a pain though (I only managed to correctly set things up once I started using Mailcow and their built in DNS check tool)

The domain still lands on some blacklists but that is down to one ISP blanket banning any mail servers in the IP block my ISP rotates my IP through.

I have both my own email server and an additional paid email provider. not expensive and has very nice functionality in terms of sync, aliases, etc.

If they now said I needed some 3rd party bullshit to access their site, I would quit paying them. There are tons of these smaller businesses.

I doubt they will just be like "oh well, guess i'll die, Daddy Google said so"

What i'm saying is, it doesn't have to be google OR become a tech wizard. There is a middle path that just costs a dollar.

I'm moving over to a more professional email now, and it's a huge pain. A password manager helps a lot.

On a rooted phone, they can still fail attestation, apparently. That's why Magisk Hide (or whatever it's called) became a thing, to hide that the device is rooted. Google Pay also apparently needs Magisk Hide to function.

I don't trust my phone to store my payment details, so I don't care about Google Pay, and my bank's app works fine while rooted, so I don't have any personal experience with it, just what I've seen in every single root guide I've used in at least the last 4 years (if not longer; I don't remember how I rooted my previous phone.)

Yeah, joke's on the commenter; Google had had device attestation for phones for ages now and it's also terrible. Many apps will outright refuse to work if you have a non-typical phone (rooted, some obscure hardware or custom OS).

This is true. However, I don't see this happening as the website/browser isn't really the problem with online banking, it's more often the user.

On another note, how about no access at all, because this is a freaking huge attack surface for (D)DOS. Imagine you just invalidate signatures of all traffic to and from an attestation service. You could almost stop countries from functioning. That's a serious vulnerability which we can easily do without.

I rarely do, but when I do it's for something a bit specific, like ordering/depositing foreign currency (for travel) or depositing large checks that exceed the online deposit limit (which again is extremely rare). For everything else, it's online only, especially since every time I go in, there's only one teller working and the line is super long.

Thank you. I was just thinking about that!

https://www.google.com/maps/search/bank/@55.6507769,9.3243604,8z/data=!4m2!2m1!6e2?entry=ttu

And that's not even getting into how banks worldwide have been cutting down on staff numbers for years, and directing people to just their apps instead.