Zerodha founder and CEO Nithin Kamath has raised concerns over the kind of permissions banking apps seek from users. He said many of them go beyond what is actually needed and raise serious concerns around user privacy and data safety.
‘I DON’T USE NET BANKING APPS ON MY PHONE’
Kamath said he avoids using net banking apps on his phone because of the permissions they demand. According to him, asking for access to SMS, contacts and phone data in the name of security does not make sense.
“I don’t use net banking apps on my phone because the mandatory permissions they ask for make no sense,” he wrote on X.
He pointed out that globally, good cybersecurity practices focus on limiting access, not expanding it.
UNDERSTANDING THE ‘LEAST PRIVILEGE’ RULE
Kamath referred to the Principle of Least Privilege (PoLP), which means apps should only ask for the minimum access required to function. This approach is widely accepted across the world as a safer way to protect user data.
Sharing Zerodha’s philosophy, Kamath said the company has consciously avoided asking for unnecessary permissions.
“Don’t do unto others what you don’t want done unto you has been at the heart of the Zerodha philosophy,” he said.
He added that the firm’s trading app reflects this thinking. He added that its trading app, Kite, does not ask for any permissions on mobile devices.
BALANCING SECURITY AND PRIVACY
Kamath also pointed out that strong regulations can ensure safety without invading user privacy. He credited Sebi’s framework for striking the right balance. He said such frameworks strike a better balance compared to relying on intrusive permissions.
His comments come at a time when more people are becoming aware of how much data apps collect. As digital payments and online banking grow, the question of how much access is really necessary is becoming harder to ignore.
