Tracking my phone's silent connections
kushaldas.in
Tracking my phone's silent connections
1–10 of 110 posts
Re: Tracking my phone's silent connections
#2Actually would be interesting to see the content of the HTTP packets that are not encrypted!
I wonder what kind of information is shared by our smartphones without it being properly secured...
Re: Tracking my phone's silent connections
#3Interesting. Though AFAIK Lookout is mostly useless on iOS, it's essentially just another "Find my iPhone" service right?
I'd be interested to know what the Google queries were for. Does he use GMail?
Re: Tracking my phone's silent connections
#4Interesting. Though AFAIK Lookout is mostly useless on iOS, it's essentially just another "Find my iPhone" service right? I'd be interested to know what the Google queries were for. Does he use GMail?
Maybe they’ve made connections into the insurance industry. For them it might be interesting what your location profile looks like.
Re: Tracking my phone's silent connections
#5Interesting. Though AFAIK Lookout is mostly useless on iOS, it's essentially just another "Find my iPhone" service right? I'd be interested to know what the Google queries were for. Does he use GMail?
Maybe they’ve made connections into the insurance industry. For them it might be interesting what your location profile looks like.
Well, THAT'S reassuring o_O
Re: Tracking my phone's silent connections
#6I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device.
I feel the push for DoH will make this even worse - because then you won't even know which servers your apps are connecting to.
Re: Tracking my phone's silent connections
#7I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…
Unfortunately Google both supports and recommends this. Recently they've even made it easy for apps to automatically ignore any custom certificates added to the trust store, so they don't even have to bother to implement pinning.
Re: Tracking my phone's silent connections
#8I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…
Same for Apple, I've had to bypass this multiple times for pen testing engagements. There are ready to use modules to patch it out, no root / jailbreaking required.
There is lots of good security reasons to do this. Further, if they didn't people would just roll a Swift / OBj-C SSL library and do it all themselves, which would be worse I think.
Re: Tracking my phone's silent connections
#9I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…
Unfortunately Google both supports and recommends this. Recently they've even made it easy for apps to automatically ignore any custom certificates added to the trust store, so they don't even have to bother to implement pinning.
Yeah, I'm honestly not surprised. Apologies for the cynicism, but sometimes I wonder if the pushes for HTTPS-everywhere, certificate transparency and DoH are really more for the privacy of app developers instead of the privacy of users...
Re: Tracking my phone's silent connections
#10I'm not sure how the situation is with Apple, but it always bothered me that on Android, apps can implement their own logic for TLS certificate validation. Apps can use this to hardcode key-pinning and make it effectively impossible (short of patching the app) to inspect an encrypted connection, even if you're the owner of the device. I feel the push for DoH will make this even worse - because then you won't even kno…
Same for Apple, I've had to bypass this multiple times for pen testing engagements. There are ready to use modules to patch it out, no root / jailbreaking required. There is lots of good security reasons to do this. Further, if they didn't people would just roll a Swift / OBj-C SSL library and do it all themselves, which would be worse I think.
Sorry for asking, but what secure reasons would that be?
If Apple wanted, they could prohibit the last point by requiring all apps to delete TLS handling to the OS and failing the review otherwise.