Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wanted to spy on my dog, ended up spying on TP-Link

kennedn.com

Post reply on HN
Print view View original

81–90 of 181 posts

Re: Wanted to spy on my dog, ended up spying on TP-Link

#81

Post by franga2000 »

bri3d wrote: post #59
josteink wrote: post #52

Earlier quoted context omitted.

So for people with any practical needs what so ever (like banking): No. At this point Android isn’t meaningfully an open-source platform any more and it haven’t been for years. On the somewhat refreshing side, they are no longer being dishonest about it.

I don't think any vendor should be solving for "I want to do app RE and banking on the same device at the same time;" that seems rather foolish. These are sort of orthogonal rants. People view this as some kind of corporate power struggle but in this context, GrapheneOS, for example also doesn't let you do this kind of thing, because it focuses on preserving user security and privacy rather than using your device as…

> But from an "I own my hardware and should use it" perspective, Google continue to allow OEM unlock on Play Store purchased Pixel phones, and the developer console will allow self-signing arbitrary APKs for development on an enrolled device [...]

But that's not really using it, is it? If the process of getting access to do whatever I want on my smartphone makes it cease to be a viable smartphone, can you really count that as being able to use it?

It's like if having your car fixed by a third party mechanic made it not street legal. It is still a car and it does still drive, but are you really still able to meaningfully use it?

And before anyone jumps on my metaphor with examples of where that's actually the case with cars, think about which cases and why. There are modifications that are illegal because they endanger others or the environment, but everything else is fair game.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#82

Post by pimterry »

mschuster91 wrote: post #51
201984 wrote: post #13

Are techniques like using Frida and mitmproxy on Android apps still going to be possible after the signing requirement goes into effect next year?

They're already barely possible as it is. For frida to work you need to root the device, which is impossible on ever more models, and there's an endless supply of very good rooting detection SDKs on the market, not to mention Play Integrity.

> For frida to work you need to root the device, which is impossible on ever more models

There's plenty of physical devices where it is possible, and Google publish official emulator images with root access for every Android version released to date. This part is still OK.

> there's an endless supply of very good rooting detection SDKs on the market, not to mention Play Integrity

Most of the root detection is beatable with Frida etc, mostly.

Play Integrity & attestation (roughly: 'trusted computing' on your phone, which signs messages as 'from an unmodified certified device' in a way that the server can verify, to only allow connections from known-good devices) is a much larger problem. Best hope here is that a) it creates much work for most apps to bother and b) it eventually gets restricted as anti-competitive. It's literally them charging & setting rules on their competitors for how they get a certificate which allows phones they make to function with all the Android apps on the market, and pushing app makers to restrict their apps to not work on phones from competitors who don't play ball, so I don't think anti-competition pushback here is that implausible medium term.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#84

Post by sureglymop »

crowfunder wrote: post #67
bri3d wrote: post #60

Earlier quoted context omitted.

> Patch iOS and Android applications, embedding a Frida gadget that can be used with objection or just Frida itself. This is the key thing, and the part that will change next year: previously, you could unpack, patch, and repack an APK with the Frida gadget and install it onto an Android device in Developer mode, while the device remained in a "Production" state (with only Developer mode enabled, and no root). Now, t…

Wow that's horrifying. I guess apk modding era is over for most users.

Not yet. If I recall correctly only very few countries affected in the beginning.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#85

Post by joostlek »

borski wrote: post #11
radlad wrote: post #10

Earlier quoted context omitted.

Absolutely. I've been using Home Assistant for around 6 years now and it's absolutely amazing for tying hardware from varying ecosystems together. Even if your hardware doesn't support local APIs, there's a good chance someone has made an HA integration to talk to their cloud API.

> Even if your hardware doesn't support local APIs, there's a good chance someone has made an HA integration to talk to their cloud API. And if they haven’t, you can pretty trivially write your own and distribute it through HACS (I’ve got three integrations in HACS and one in mainline now)

I'd love to see what's needed to get some of these integrations in core!

Re: Wanted to spy on my dog, ended up spying on TP-Link

#86

Post by stavros »

pimterry wrote: post #73

Oh awesome, this is using my Frida scripts! These: https://github.com/httptoolkit/frida-interception-and-unpinn... . Nice project, great to see the scripts doing good work in the wild. If you needed any extra additions or tweaks to get them working, I'd love to hear about it.

HTTP Toolkit is fantastic, great job Tim!

Re: Wanted to spy on my dog, ended up spying on TP-Link

#87

Post by bri3d »

Wowfunhappy wrote: post #80
bri3d wrote: post #78

Earlier quoted context omitted.

* Your bank (and Google) want to deal with as little fraud as possible. * Market forces demand they provide both a website and an Android app. * If both platforms are equally full of fraud, have the same features, and both have similar use, they cut out half the fraud even if they can only make one or the other fraud proof. * But it isn't like that in reality: in reality, something more like 80% of their use and 90%…

Why does most fraud come from locked down mobile devices and not open Windows/Linux PCs? If it's true that 90% of fraud comes from mobile despite all of the restrictions, what that tells me is that locking down devices doesn't actually prevent fraud. --- > before we even get into the mobile app having features the desktop one does not (P2P payments, check deposit, etc.) I think it would be reasonable to disable those…

> If it's true that 90% of fraud comes from mobile despite all of the restrictions

Statistics on mobile vs. desktop banking will really shock you; the mobile usage penetration is easily well upwards of 90% in many markets. There's also a skewed distribution for fraud-vulnerable users and scenarios.

> I think it would be reasonable to disable those specific features on mobile while leaving the rest of the app accessible.

I agree with you in an idealist sense; it would be awesome to be able to use GrapheneOS and have 80% app functionality instead of 0% app functionality. I also completely understand why nobody does it; supporting what's probably <0.001 (if not lower)% of legitimate users in exchange for development time and fraud risk isn't a particularly appealing tradeoff. If I were in a situation to advocate for such a trade-off, I probably would, but I don't think it's evidence of a sinister conspiracy that nobody does that.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#88

Post by g-mork »

ck2 wrote: post #53

tapo annoyingly is also one of the only cameras that doesn't have a still snapshot url after all these years and endless requests from many someone needs to make replacement firmware ffmpeg can fake it but takes a few seconds to grab from the video stream and of course you can't run ffmpeg from your browser (or wait, can you now?) ffmpeg -rtsp_transport tcp -i "rtsp://cameraname:camerapass@192.168.1.23:554/stream1" -…

try reducing your buffer size and -probesize to help with that delay (and/or optionally fixing the video format parameters so probing isn't needed at all)

Re: Wanted to spy on my dog, ended up spying on TP-Link

#89

Post by selinkocalar »

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

Re: Wanted to spy on my dog, ended up spying on TP-Link

#90

Post by teaearlgraycold »

selinkocalar wrote: post #89

IoT security is generally terrible, but the fact that consumer routers are essentially unaudited black boxes processing all your network traffic is genuinely concerning. Most people have no idea their router firmware hasn't been updated in years and is probably running known CVEs. The supply chain trust model for networking hardware is broken.

The solution is pfsense
Post reply on HN