Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trusting clients is probably a security flaw

liberda.nl

Post reply on HN
Print view View original

31–40 of 150 posts

Re: Trusting clients is probably a security flaw

#31

Post by netdevphoenix »

nonrandomstring wrote: post #22
netdevphoenix wrote: post #15

Earlier quoted context omitted.

> People need to be able to say "I studied what you asked me to make, and refuse to work on this illegal, insecure, depressing cruft, and if you fire me for having professional ethics my lawyers will empty your company bank account." This only works if everyone or the vast majority join unions. Otherwise, those who join will get penalised with lower offers or no offers at all.

> This only works if everyone or the vast majority join unions. This is a common objection but I think it's wrong. Putting aside the huge differences between US (at will) and global employment law, the idea of a fluid, frictionless workforce is quite the myth. Keeping wages down and conditions poor very much relies on the propagation of that myth that ethics will work against you. so please be careful not to do yours…

> any employers would survive long if it transpired they were disfavouring members of IEEE, ACM, IET or whatever.

I highly doubt most employers even know what those organisations are. Taking it even further, there is probably even a significant amount of devs that are unaware of them as well. I don't think devs have this much power. Unless you are a tech company, devs are likely highly replaceable and in my opinion the trend goes in that direction. Obviously, this excludes skilled FAANG devs

Re: Trusting clients is probably a security flaw

#32

Post by HeatrayEnjoyer »

robertlagrant wrote: post #28
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…

By default you can `ls` almost anything on an entire drive.

Re: Trusting clients is probably a security flaw

#33

Post by Over2Chars »

Hilariously well written.

"But the problem with checking if the user is a god, is that the user is a god. They can just tell you what you want to hear."

NISUS: Good. Out of the door. Line on the left. One cross each. Next. Crucifixion?

MR. CHEEKY: Ah, no. Freedom.

JAILER: Hmm?

NISUS: What?

MR. CHEEKY: Eh, freedom for me. They said I hadn't done anything, so I could go free and live on an island somewhere.

NISUS: Oh. Oh, well, that's jolly good. Well, off you go, then.

MR. CHEEKY: Naa, I'm only pulling your leg. It's crucifixion, really.

The author earned a discount on his Big Mac.

Re: Trusting clients is probably a security flaw

#34

Post by izacus »

pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

Well, they're also an app that relies (at least on Android) on Google's Play Integrity DRM to "keep it safe" from those pesky root users. And like clockwork, this false sense of security leads developers into stupidly trusting the client.

Re: Trusting clients is probably a security flaw

#35

Post by red_trumpet »

izacus wrote: post #34
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

Well, they're also an app that relies (at least on Android) on Google's Play Integrity DRM to "keep it safe" from those pesky root users. And like clockwork, this false sense of security leads developers into stupidly trusting the client.

I don't know much about this. Is this a (possible fundamental) flaw in Google's Play Integrity DRM, or did the developers implement it wrongly?

Re: Trusting clients is probably a security flaw

#36

Post by ksp-atlas »

graemep wrote: post #6
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

The app works for me just fine despite having lots of non-google play apps installed, is this an Android 15 thing?

Re: Trusting clients is probably a security flaw

#37

Post by codetrotter »

red_trumpet wrote: post #35
izacus wrote: post #34

Earlier quoted context omitted.

Well, they're also an app that relies (at least on Android) on Google's Play Integrity DRM to "keep it safe" from those pesky root users. And like clockwork, this false sense of security leads developers into stupidly trusting the client.

I don't know much about this. Is this a (possible fundamental) flaw in Google's Play Integrity DRM, or did the developers implement it wrongly?

It makes sense, to some degree, that for example some banking apps refuse to run if they detect that the phone has been rooted, or even to go as far as to refuse to run if there are non-Play apps on the phone.

Maybe some apps with DRM media playback do this kind of check too, yes. Haven’t used Android for many years now.

Hopefully iOS stays the way it is where apps don’t get so much info about other apps on device. I prefer it that way.

Re: Trusting clients is probably a security flaw

#38

Post by latexr »

2phonesguy wrote: post #29

[flagged]

This is literally your first and only comment. From your username it looks like you made it specifically for that remark. I recommend you peruse the guidelines, as this type of unsubstantive flamebait is explicitly against HN rules.

https://news.ycombinator.com/newsguidelines.html

Re: Trusting clients is probably a security flaw

#39

Post by 1317 »

graemep wrote: post #6
pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

It used to let you use it with a full-on rooted phone, it just popped up a message saying 'it's not our problem if you get robbed'

i wonder what caused the change

as others have said, you can ring them up and get a physical security key, it works for the website

Post reply on HN