Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pokemon Go, Security, and Obsolescence

community.rapid7.com

Post reply on HN
Print view View original

81–90 of 109 posts

Re: Pokemon Go, Security, and Obsolescence

#81

Post by evilDagmar »

brbsix wrote: post #34
pja wrote: post #32

You can unroot CyanogenMod running on the Nexus 4 & Pokemon Go will run just fine. You have to give the SuperSU app root privileges in order to unroot ironically, but it works just fine & you can always root your system from the bootloader in the future if it turns out that you need root for some reason. There’s an app in the Play Store that runs the tests the Google library that Niantic is using to check whether a p…

This is the app I've used in the past: https://play.google.com/store/apps/details?id=com.scottyab.s... Also I was under the impression that SafetyNet would only pass on stock ROMs (to include official CyanogenMod builds lacking root). Is that not true? Will it also pass on any custom ROM lacking root? Edit: According to http://androiding.how/use-android-pay-cm14-cm13/ , SafetyNet (the tamper detection API in use by A…

Well, it's not like you haven't seen bloggers talking through their hats before, right? The amount of cargo cult nonsense in Android "news" kills me.

SafetyNet is completely fine with a nightly of CM13 (on Samsung Galaxy S5) after the su binary and it's accompanying symlink are renamed to get them out of sight (and effectively disabled). You don't have to touch the settings in developer options at all because SafetyNet isn't going on some extended search to look for the setting. It's just looking for the presence of an su binary in the filesystem in a few places during that phase of its checks.

Re: Pokemon Go, Security, and Obsolescence

#82

Post by ferbivore »

RDaneel0livaw wrote: post #69
ferbivore wrote: post #64

Earlier quoted context omitted.

"Stock Android" is only stock Android on Google-branded devices.

I don't understand this sentence. Google only has a single phone that has only been out for like 1 day now, the Pixel. And it's not even stock Android, it's got extra features that the stock Nougat doesn't have. Again though, I think this whole thing is moot, because lots of phones have roms on xda that is basically just stock android with no customizations, so just install that and be done with it.

I said Google-branded, not Google-manufactured. The Nexus line is what people typically understand by "stock Android".

The point isn't that there are no vanilla AOSP ROMs for most devices. The point is that they usually suck, and a reputable well-supported one that actually worked properly would be a massive innovation.

Re: Pokemon Go, Security, and Obsolescence

#83

Post by evilDagmar »

curiousgal wrote: post #29
Kiro wrote: post #24

Earlier quoted context omitted.

How so? I play Pokémon Go and can't think of a single thing they've done that has spoiled the experience for me. Neither can my friends. We love the game as it is. Bear in mind we are casual players, like most are.

Granted it's not the most representive sample but a glance through https://www.reddit.com/r/pokemongo shows that the majority of people are complaining. I live by a park where there are 3 Pokestops and a Gym and it used to be mildly crowded, now it's empty. It's obvious that the game has died down and it all can be traced back to when Niantic broke the tracking system and proceeded to go after Maps. Every "anti-cheat…

I'm pretty sure they've been going after the mapping people both because those guys add a ridiculous load to the map servers, and because eventually people are going to start asking serious questions about why all of two cities have varying spawn areas for Pokemon, and the rest of the world put together has about as much detail as those two cities.

If you're not in San Francisco or New York, sadly, your most efficient method of "catching them all" is to simply sit and camp lures, because what doesn't spawn from that isn't going to spawn anywhere nearby so there's little point in searching. Flogging an RNG endlessly is _not fun_, and that's apparently a heavy player in what's driving players away from the game.

Re: Pokemon Go, Security, and Obsolescence

#84

Post by nucleardog »

RDaneel0livaw wrote: post #69
ferbivore wrote: post #64

Earlier quoted context omitted.

"Stock Android" is only stock Android on Google-branded devices.

I don't understand this sentence. Google only has a single phone that has only been out for like 1 day now, the Pixel. And it's not even stock Android, it's got extra features that the stock Nougat doesn't have. Again though, I think this whole thing is moot, because lots of phones have roms on xda that is basically just stock android with no customizations, so just install that and be done with it.

ADP1, Nexus One, Galaxy Nexus, Nexus 4, Nexus 5, Nexus 6P.

When people say "Google's phones" it is generally understood to mean the unlocked line of Nexus devices that they sell directly and provide updates/firmware images for directly.

Re: Pokemon Go, Security, and Obsolescence

#85

Post by nradov »

I find it both hilarious and disappointing how much effort is going into an escalating arms race between video game cheaters and cheat detection. Considering that the players can't even win anything of real value. I think future archaeologists will see this whole thing as a bizarre ritual and struggle to understand what was really going on.

"A strange game. The only winning move is not to play. How about a nice game of chess?"

Re: Pokemon Go, Security, and Obsolescence

#86

Post by lern_too_spel »

nradov wrote: post #79
pwnna wrote: post #71

Earlier quoted context omitted.

> How much of a hassle is it really, because I absolutely want system wide ad blocking and I worry that I will be defeating the purpose of using a hardened OS in the first place? Ad-away works by using a host file to block. The hosts file is generally not writable by the user without root as it lives on a read only partition (/system). Another way to block ads is to connect to a VPN that blocks thoses hosts for you,…

Apple added specific ad blocking features to iOS 9, and I don't think those rely on editing the hosts file. So in principle a similar design could work for Android, although I doubt Google would ever support that.

Apple added specific ad-blocking features to its browser on iOS 9. There are plenty of browsers that support ad blocking on Android, and they have existed since pretty much the beginning.

It is also possible to block ads in other apps on Android. One way is to use a custom hosts file that blackholes ad-serving domains. The hosts file is stored on a read-only partition for security purposes on most builds of Android, so overwriting it requires root. Another option is to point your phone to a DNS server that does the same thing. This does not require root and works across multiple platforms. Another Android-specific option is to use the VpnService API to implement filtering in an app that does not use root but gets to see all other apps' Internet traffic. There are several apps that do this.

Re: Pokemon Go, Security, and Obsolescence

#88

Post by lern_too_spel »

pwnna wrote: post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

Yes, the author makes the fundamental mistake of thinking that custom ROMs and having root access are the same thing. It is possible to have a custom ROM that does not give the user root access, and such a configuration is more secure for the user.

Re: Pokemon Go, Security, and Obsolescence

#89

Post by pwnna »

evilDagmar wrote: post #76
pwnna wrote: post #2

Now Niantic's decision to disallow root devices, imo, is pretty regretful, as serious botters will likely be able to get around that restriction regardless. This only serves to punish users who are stuck between having a root-enabled custom ROM or a stock ROM where critical root exploits may exist. One thing that I observed is that no one seems to be interested in producing a ROM that is both stable, has a variety of…

You literally didn't need to do any of this (and I'm astonished someone would wait through a CM build rather than do ten minutes of research). Also, I'd like to remind you that SEAndroid (i.e., SELinux) doesn't give a fig about "root" so your statements about that are quite wrong. You can simply rename your su binaries through the recovery environment to disable them, which neatly disables "root access" and makes the…

> You literally didn't need to do any of this.

For me personally, this is not the reason for me to build CyanogenMod. I will occasionally modify certain things inside android to suit my needs and there are enough of these things that are not merged upstream that it's more convenient for me to just build my own version every month/week/whenever.

> Also, I'd like to remind you that SEAndroid (i.e., SELinux) doesn't give a fig about "root" so your statements about that are quite wrong.

This is an area i'm not quite informed, so maybe you can elaborate further.

The core issue that I wanted to express is that barely any community ROMs are CTS compliant, which is ultimately what SafetyNet checks.

> You can simply rename your su binaries through the recovery environment to disable them, which neatly disables "root access" and makes the SafetyNet check Niantic is invoking pass with flying colors. Should you need them again, they're only a reboot and couple of mv invocations away.

Doing a bunch of mv's is a hassle (esp over multiple devices) as I rarely ever need root on my phone. The only times when I need it nowadays is host based ad blocking, which I just integrated into my ROM. So this way I can just get rid of root all together, which is one more step towards CTS compliance.

Re: Pokemon Go, Security, and Obsolescence

#90

Post by slavik81 »

rsheridan6 wrote: post #50
Fiahil wrote: post #49

After Niantic's move to "encrypt" API calls (which was broken a few days after, btw), I'm not surprised they would arbitrarily block some devices based on phony explanations. Bear in mind, bots have little to no effects on the game itself because you have little to no virtual interactions with other players. It's not like you were able to trade Pokémons you caught with someone else.

You do interact with other players via gym battles, and if gyms are dominated by cheaters it ruins the game for everyone else.

It is a problem that cheaters will fill gyms with ridiculously strong pokémon. Unfortunately, if you started playing significantly after release, even legit players are so much stronger that the game experience is the same. Alas, the underlying problem is bad game design.
Post reply on HN