This article is dated 2023
Trusting clients is probably a security flaw
61–70 of 150 posts
Re: Trusting clients is probably a security flaw
#62Earlier quoted context omitted.
Why would you want to continue working at such a place as a developer? It's not like it's hard to find another job as developer...
Entry-level jobs? Sure. Senior level and above? You must have been living under the rock for the past year. Then again, mobile apps are like this tend to be junior work, outsourced to software mills that just burn through juniors cranking out garbage assembled 10% of polyfills and 90% of advertising SDKs. Yes, at this point of your career, you can still say "no" - the company will happily replace you with some other…
It's easy to find entry level jobs? Where? I was trying for ages and barely anyone even replied to my applications
Re: Trusting clients is probably a security flaw
#63Does anyone else remember the days of bottle cap instant-wins? I don't want these apps. Remember affordable fast food? I spent $14.74 to wait in drive thru for 15 minutes to eat cold fries and a slice of patty with cardboard bacon and solidified cheese whizz? Can't blame the staff, they aren't seeing any of those profits.
Re: Trusting clients is probably a security flaw
#64This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???
As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.
I assumed there is always some technical documentation/app architecture and some mandatory (server side) security you have to follow, but reading this I'm being too optimistic.
Re: Trusting clients is probably a security flaw
#65Earlier quoted context omitted.
> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…
Is it not the same for computers most of the apps data is accessible by all the apps. Mobile OS came from the paradigm of the past and as the way we use our phones change so do the way how mobile os work. For a long time Android devs have wanted to obfuscate the disk from the user like iOS does but have faced push back from users and developers so in the end they created a permission where an app needs to ask permiss…
Definitely the same for computers. LOTS of software rely on saving data on "secret" locations for shareware-style trials.
macOS for one has been asking to allow access to specific folders. Other OSs are possibly starting to do the same, but it used to be a free-for-all.
Re: Trusting clients is probably a security flaw
#66I thought not trusting clients was already security 101?
We're at something like 116 now and they keep coming up with funny terms for it.
secure enclaves, secure virtualization, trusted execution environment, trusted platform, confidential computing, protected execution, LaGrande, protected launch, hardware attestation, ..
Re: Trusting clients is probably a security flaw
#67Earlier quoted context omitted.
As a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.
Can't the client sue for damage though? Especially in a courtroom-happy country like the US, perhaps causing financial trouble to a corporation the size of McDonald's would not exactly lead to a happy, carefree livelihood
A company doing outsourced dev for someone the size of McDonald’s would have an iron clad statement of work that the would point to and say “show us where you asked for server validation”
Re: Trusting clients is probably a security flaw
#68Earlier quoted context omitted.
> the worst that can happen To you, you mean, right?
That goes without saying in the software business today. I was in software for decades and I’ve never seen it so cynical. Shameless profiteering seems to be the gold standard strategy. It’s like Gordon Gecko style greed.
It's hardly surprising. Once they smelled cash in the water all the Gordon Geckos packed up their finance bags and moved into tech.
Re: Trusting clients is probably a security flaw
#69This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???
This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…
The HSBC UK app runs perfectly well on my Android phone, including full biometrics, 2FA for the website and for major functionality like transferring money.
I have at least a dozen apps installed on my phone that are not from the Play Store - a mixture of other stores (Samsung/Epic) and apps that are not from any store but I've compiled myself, or downloaded APKs directly from the developer website.
This isn't true.
Re: Trusting clients is probably a security flaw
#70Earlier quoted context omitted.
This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…
It used to let you use it with a full-on rooted phone, it just popped up a message saying 'it's not our problem if you get robbed' i wonder what caused the change as others have said, you can ring them up and get a physical security key, it works for the website
The app works perfectly well on my device, parent comment is just mistaken.