Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trusting clients is probably a security flaw

liberda.nl

Post reply on HN
Print view View original

121–130 of 150 posts

Re: Trusting clients is probably a security flaw

#121

Post by SpaghettiCthulu »

liontwist wrote: post #43
robertlagrant wrote: post #28

Earlier quoted context omitted.

> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I wa…

That is how it works. Apps on android and iOS can’t access data outside of their contsiner.

Afaik all apps on android have the ability to list directories across most of the "sdcard" file system even without storage permissions.

Re: Trusting clients is probably a security flaw

#122

Post by graemep »

jimjambw wrote: post #106
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

Do you happen to remember which bus company this was? Is there any article you can link me too as I’m quite interested in reading some more on it.

I think it was Arriva. Defineitely one that operated in Manchester st the time. Cannot find a link.

Re: Trusting clients is probably a security flaw

#123

Post by graemep »

White_Wolf wrote: post #100
graemep wrote: post #6

Earlier quoted context omitted.

This sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app…

The HSBC app runs fine on my rooted phone with a few magisk plugins and 5 marketplaces installed and a ton of sideloaded apps.

It used to work on my old phone. Stopped with nee one. May depend on Android version or when you installed.

Re: Trusting clients is probably a security flaw

#124

Post by Zak »

atrus wrote: post #108
some_random wrote: post #98

Earlier quoted context omitted.

That's entirely reasonable, but I think it's unlikely to make a difference in most cases.

No, but it's a papercut. You can piss off 1% of your customers and get 1 star reviews, but do that a bunch of times and it adds up.

I'd be happy if the number leaving negative reviews was that high.

Re: Trusting clients is probably a security flaw

#126

Post by TeMPOraL »

SpaghettiCthulu wrote: post #121
liontwist wrote: post #43

Earlier quoted context omitted.

That is how it works. Apps on android and iOS can’t access data outside of their contsiner.

Afaik all apps on android have the ability to list directories across most of the "sdcard" file system even without storage permissions.

Sure, but all the interesting data is stored in a subtree that mostly won't even show on that list. In fact, there doesn't seem to be a way for a user of non-rooted phone to view this data. This sucks.

Re: Trusting clients is probably a security flaw

#127

Post by TeMPOraL »

miki123211 wrote: post #48
1317 wrote: post #39

Earlier quoted context omitted.

It used to let you use it with a full-on rooted phone, it just popped up a message saying 'it's not our problem if you get robbed' i wonder what caused the change as others have said, you can ring them up and get a physical security key, it works for the website

> i wonder what caused the change In many countries, if the consumer gets defrauded, the bank foots the bill. I don't think the problem here is consumers getting defrauded by having an insecure rooted device. It's fraudsters using the mobile app APIs for nefarious purposes, and the best way to prevent that is to use SafetyNet and other similar mechanisms.

> and the best way to prevent that is to use SafetyNet and other similar mechanisms.

It's not the best way to prevent it. It's the easiest way for the bank to avoid liability.

The ugly truth of cybersecurity is that, in the real world, most of it is an exercise in shifting liability around and diffusing it. Making systems actually secure is not necessary.

Re: Trusting clients is probably a security flaw

#128

Post by TeMPOraL »

creer wrote: post #114
prmph wrote: post #16

I thought not trusting clients was already security 101?

> I thought not trusting clients was already security 101? Of course it is. Always has been. The security field is riddled with complete nonsense. Much of it even couched in terms of "best practices". It's the perfect field for people with zero specific knowledge or experience to be trusted with management or engineering - since it doesn't matter until it did matter, at which point a mild non-apology is usually suffi…

Security field isn't about security, it's about managing liability. "Best Practices" don't need to result in actual security - what matters is that, if you follow them and a security incident happens, you can say you followed the Best Practices and therefore It's Not Your Fault.

Re: Trusting clients is probably a security flaw

#129

Post by JadeNB »

TeMPOraL wrote: post #126
SpaghettiCthulu wrote: post #121

Earlier quoted context omitted.

Afaik all apps on android have the ability to list directories across most of the "sdcard" file system even without storage permissions.

Sure, but all the interesting data is stored in a subtree that mostly won't even show on that list. In fact, there doesn't seem to be a way for a user of non-rooted phone to view this data. This sucks.

Do you mean Android/data? This is accessible on a non-rooted device using Marc apps & software's "Files" https://play.google.com/store/apps/details?id=com.marc.files (an easily accessible shortcut to the native Android file manager).

Re: Trusting clients is probably a security flaw

#130

Post by creer »

TeMPOraL wrote: post #128
creer wrote: post #114

Earlier quoted context omitted.

> I thought not trusting clients was already security 101? Of course it is. Always has been. The security field is riddled with complete nonsense. Much of it even couched in terms of "best practices". It's the perfect field for people with zero specific knowledge or experience to be trusted with management or engineering - since it doesn't matter until it did matter, at which point a mild non-apology is usually suffi…

Security field isn't about security, it's about managing liability. "Best Practices" don't need to result in actual security - what matters is that, if you follow them and a security incident happens, you can say you followed the Best Practices and therefore It's Not Your Fault.

You are right. And by now an "it will be fixed next month" seems to be enough. even when nothing is fixed.
Post reply on HN