Trusting clients is probably a security flaw

Post by Zak » Fri, Jan 17, 2025, 4:41 PM UTC

rollcat wrote: post #89

Zak wrote: post #73

If an app tries to detect that I have root or a non-stock OS, I will give it a 1-star review on Google Play 100% of the time. Everyone who has a rooted device should do this.

One good reason why "honest" app vendors do this is because providing tech support for custom OS's (in addition to the wide variety of popular handsets) is more costly. They also might not want the responsibility - in case something like your banking app gets pwned by random malware, they want to blame the OS vendor. CYA is always a good strategy. But if someone is seriously thinking client-side security works, yeah…

Post by LinuxBender » Fri, Jan 17, 2025, 4:42 PM UTC

daft_pink wrote: post #83

McDonald’s is seriously the strangest company when it comes to the way they push your app at you. They literally ask you if they’ve installed their app as the first question when you show up at a drive-thru. I don’t trust them at all and there is no way I’m installing their stupid app.

Post by some_random » Fri, Jan 17, 2025, 4:47 PM UTC

pta2002 wrote: post #2

This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???

Post by maeil » Fri, Jan 17, 2025, 4:53 PM UTC

JimDabell wrote: post #90

maeil wrote: post #72

I'm about 90% sure that for some inane reason, McDonalds outsources and creates separate apps for each country/region with these disastrous security flaws, except that at HQ they universally demand horrifically counter-productive "anti-root" measures for every locale, to a larger extent than even finance apps. Why am I so sure about this? I live on the other side of the world, the app is almost certainly an entirely…

I’ve worked on apps like this for companies like this. What happens is that their IT department mandates an expensive pen test for suppliers, anti-root requirements are on the pen-tester’s generic checklist, and most companies won’t push back on the pen test results. If you do, they normally fold and admit it’s not required.

Post by yjftsjthsd-h » Fri, Jan 17, 2025, 5:08 PM UTC

rollcat wrote: post #89

Zak wrote: post #73

If an app tries to detect that I have root or a non-stock OS, I will give it a 1-star review on Google Play 100% of the time. Everyone who has a rooted device should do this.

One good reason why "honest" app vendors do this is because providing tech support for custom OS's (in addition to the wide variety of popular handsets) is more costly. They also might not want the responsibility - in case something like your banking app gets pwned by random malware, they want to blame the OS vendor. CYA is always a good strategy. But if someone is seriously thinking client-side security works, yeah…