Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android saves wifi passwords in plaintext to the cloud

code.google.com

Post reply on HN
Print view View original

161–170 of 172 posts

Re: Android saves wifi passwords in plaintext to the cloud

#161

Post by antimagic »

packetslave wrote: post #156
antimagic wrote: post #88

Earlier quoted context omitted.

This, in addition to Google's demonstrated willingness to hand user data over to the US government means that the government (or a rogue Google employee, or a hacker that gets access to Google's database, or a rogue member of the US government, or ... you get the picture) can hit you with a LAN-based MotM attack pretty much whenever they wish. That means they can own your computer, because your Android phone connecte…

I realize you're just being a troll, but what you really mean by "Google's demonstrated willingness to hand user data" is "[...] comply with U.S. law and valid court orders while doing everything they can to push back on overly-broad fishing expeditions by the government." Yes, I'm a Googler, and yes I'm tired of hearing this horseshit. Every single U.S. company complies with warrants, court orders, NSLs, and FISA de…

Are you suggesting that Google doesn't hand over data? Google has decided to do that because it's good for business (in the sense that going up against the US government is bad for business, and realistically would require Google to move overseas). That's fine, but it changes nothing of the fact that they will hand over data requested by the US government, which means that my comment was perfectly valid.

You seem uncomfortable with the consequences of that. Maybe you should re-evaluate your own relationship with Google - do you really want to be party to these shenanigans?

Re: Android saves wifi passwords in plaintext to the cloud

#162

Post by jlgreco »

anigbrowl wrote: post #142
moxie wrote: post #122

Earlier quoted context omitted.

One way to do it would be: 1) Your plaintext password is used to generate two derivative tokens. One for user authentication with Google, and one for encrypting data stored with Google. The authentication password token is PBKDF2(N, password) and the encryption token is PBKDF2(N-1, password). You give Google the authentication token on signup. They are not capable of deriving the encryption token from it, but the use…

How are you going to check in with the backup server if you don't have a working wi-fi connection?

Flash the device with the password (this time encrypted) before shipping it to the user?

How is it usually done?

Re: Android saves wifi passwords in plaintext to the cloud

#164

Post by nwh »

yardie wrote: post #160
nwh wrote: post #155

Earlier quoted context omitted.

Heh, even the longest possibly WEP key can be broken in a few minutes with consumer hardware. At least ISPs in Australia use WPA as standard.

They use WPA2 now and from a few years ago. The cheap wifi-routers they sent out years ago didn't have the muscle to do WPA encryption.

Our have for a while too. Sure the password is the hash of the the routers MAC and the manufacture date, but they did try.

Re: Android saves wifi passwords in plaintext to the cloud

#165

Post by jiggy2011 »

Afforess wrote: post #131
moxie wrote: post #122

Earlier quoted context omitted.

One way to do it would be: 1) Your plaintext password is used to generate two derivative tokens. One for user authentication with Google, and one for encrypting data stored with Google. The authentication password token is PBKDF2(N, password) and the encryption token is PBKDF2(N-1, password). You give Google the authentication token on signup. They are not capable of deriving the encryption token from it, but the use…

Chances of me implementing this correctly: 0%. Chances of me implementing a boolean on/off switch for the plaintext passwords correctly: 99%

It shouldn't be insurmountably difficult and it's easily abstractable to more or less backup(uid,pass,data) restore (uid,pass,data).

Re: Android saves wifi passwords in plaintext to the cloud

#166

Post by fooqux »

MarkMc wrote: post #149
anigbrowl wrote: post #142

Earlier quoted context omitted.

How are you going to check in with the backup server if you don't have a working wi-fi connection?

Using a 3G connection, perhaps? In any case such a problem doesn't excuse Google from storing plaintext rather than encrypted passwords on the server.

Android is used on more than just smartphones. There are many tablets that don't have cell radios in them.

Re: Android saves wifi passwords in plaintext to the cloud

#167

Post by shameless_1 »

throwaway2048 wrote: post #145
shameless_1 wrote: post #48

Earlier quoted context omitted.

> Google has harvested the location, name and signal strength of many millions of wireless networks across the world Don't forget that that dataset of wireless locations is updated continuously through crowdsourcing.

to make this a bit clearer, android, apple, etc devices send back wifi BSSID+GPS coordinates to the mothership for AGPS purposes. Im really suprised there hasn't been more concern about this.

As an engineering project this is truly a resourceful and rather elegant solution to tune a Kahlman filter for positioning. But on the level of privacy ... big consequences. The BSSID allows tracking when someone moves to a different place. And since that's tied to GPS with multiple captures over time you get a pretty accurate location for the WiFi device.

Re: Android saves wifi passwords in plaintext to the cloud

#168

Post by packetslave »

antimagic wrote: post #161
packetslave wrote: post #156

Earlier quoted context omitted.

I realize you're just being a troll, but what you really mean by "Google's demonstrated willingness to hand user data" is "[...] comply with U.S. law and valid court orders while doing everything they can to push back on overly-broad fishing expeditions by the government." Yes, I'm a Googler, and yes I'm tired of hearing this horseshit. Every single U.S. company complies with warrants, court orders, NSLs, and FISA de…

Are you suggesting that Google doesn't hand over data? Google has decided to do that because it's good for business (in the sense that going up against the US government is bad for business, and realistically would require Google to move overseas). That's fine, but it changes nothing of the fact that they will hand over data requested by the US government, which means that my comment was perfectly valid. You seem unc…

Did you even read what I wrote? Yes, Google will hand over user data in response to a legal demand from the U.S. government (warrant, court order, NSL, etc.). So will every other company in the US, whether it's Yahoo, Rackspace, Amazon, or Joe's Linux Servers, Inc. It's called "obeying the law". Characterizing this as "Google's demonstrated willingness to hand user data over to the US government" is dishonest.

Google is one of the industry leaders in being transparent and open about government requests for data (http://www.google.com/transparencyreport/) and in fighting the government on improper or overly-broad data requests, or those that don't exactly follow the legal procedures. I'm perfectly happy with my relationship with them. I'm quite unhappy with the U.S. legal environment that allows things like secret FISA orders, but that's hardly Google's fault.

Re: Android saves wifi passwords in plaintext to the cloud

#169

Post by ctb_mg »

js2 wrote: post #83
bhauer wrote: post #35

Yet another place where I feel a tinge of anger that VPNs utterly failed to deliver on the potential of private secure connectivity to personal data storage from anywhere. Several of us here at HN set up and manage home networks to which we connect over an encrypted channel. To us--well, to me at least--it seems plain as day that my device should allow me to backup its sensitive data to a file that I store on a file…

Back to my Mac pretty seamlessly establishes an ipsec connection back to a time capsule or other Mac on your home network.

Yes, but as far as backups and backup security is concerned -- a time capsule is fairly proprietary, and a Mac on your home network is susceptible to local catastrophe.

Re: Android saves wifi passwords in plaintext to the cloud

#170

Post by lostlogin »

cbr wrote: post #157
sneak wrote: post #152

Earlier quoted context omitted.

This is not the normal Google Account password, this is specifically for a backup/restore process.

People have enough trouble remembering one password. Add another that is used only in very unusual circumstances and nearly no one will remember it.

I wonder what percentage of people use the email reset for every access attempt. I have several services where I went from crappy passwords to good ones I don't know - I just reset them each time.
Post reply on HN