Ultimately, Web Identity Federation or Federated Identity is the only way to secure apps in walled gardens, which means aligning yourself with a virtual land Barron. I, for one, welcome our new fiefdom overlords. Everything else is just pushing new credentials through temp credentials and obfuscating it with protocol complexity.
Amazon Is Downloading Apps From Google Play and Inspecting Them
101–110 of 113 posts
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#102is decompiling an app legal? does it not break someone's terms of service?
You must be new here.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#103is decompiling an app legal? does it not break someone's terms of service?
Decompilation isn't even needed. They know the credential being sent so an if(strings | grep -c "foo") != 0 SendEmail() is all that is required.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#104This seems to be the natural outcome of Amazon's excellent customer service policy, where they have on numerous occasions[0] refunded costs for hacked instances. When they commit to that policy, they have a huge incentive to limit customer security breaches. I love examples like that where a company's policies result in incentives that are so well-aligned with those of their users. Does anyone have other good example…
I had this idea that Amazon was this huge corporation that I'd never be able to get through to a human with. I spawned a bunch (4 actually) of instances in some region and forgot about them. Due to their bad ui (at the time), I couldn't see them when I logged in so I ended up getting charged heavily for them. Called up and they refunded me. Turns out I never terminated the instances. Just stopped them. Next month, I get billed again. Given the misunderstanding on my part, they more than happily refunded me and renewed my free year of the micro instance.
I really like their customer service and hope it stays how it is. I think if Walmart or insert big box company here did stuff like that, people would shop there more. Look at Nordstrom's with their insane refund policy (in the customer's favor). I think Costco does something like this as well, but I'm not a cardholder.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#105Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#106Earlier quoted context omitted.
Some people don't realise their apps can be decompiled, it's not a question of sanity.
I don't think I've ever encountered that particular illusion in anyone making a living off writing compiled code, only very new developers and non-engineer managers. It's one of the few securityish things that seems to be successfully beaten into everyone's head pretty early on. (And more often than not, they get there all by themselves -- such people usually appear on my radar asking questions showing they've figure…
I give talks at development conferences where I mostly blow people's minds by showing how easy it is to pull information out of binaries (both statically and dynamically); there are always tons of questions from the audience afterwards about "but we do X? doesn't that make us safe?", so I have to sit there shooting down a ton of silly ways of obfuscating their data, showing how each one could be defeated, but it "clicks" for everyone that there is no safe way to do this.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#107Earlier quoted context omitted.
Those are examples of AWS-like facilities. The embedded keys are not secret credentials that allow people to control your account! If you are embedding your account credentials from Urban Airship or Flurry in your app, you are badly misusing their APIs. They provide facilities for generating certificates/keys for each application.
Urban Airship actually instructs you to create a plist file for an iOS app where you specify your production app keys. http://docs.urbanairship.com/build/ios.html
The point is that these keys do not let you control the account: they only let you inject potentially-fake data; if these keys also let you register new applications, delete data, download data, or send information to third-parties, then that would be a serious problem. (In the case of Urban Airship, as opposed to Flurry, I don't know as much about the specific use case, but it would surprise me if the scenario were drastically different.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#108I'm being dumb. I can see that it is preferable to embed credentials for a restricted IAM acct, not your root/master AWS account. But how does using a TVM improve the situation? Surely you still need to embed creds which allow the app to use the TVM? In that case, an attacker can extract those creds, and ask the TVM for a time-limited token any time they like. How does using a TVM improve security over embedding the…
Your token service would authenticate users using their credentials for your system.
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#109Earlier quoted context omitted.
I don't think they're looking for higher than average API calls for a given key because my charges were completely expected.
raj, just saw your post on here. I was wondering if you were the same guy Dennis in Delaware was trying to connect us to. We were doing the large scale touchscreen collaboration stuff
Wait, there's someone in Delaware besides me? Unpossible!
Re: Amazon Is Downloading Apps From Google Play and Inspecting Them
#110We wrote a blog post that shows how you can authenticate your users and get temporary security credentials from AWS based on the user tokens to avoid putting your keys on the client (both JavaScript apps in the browser or native apps). This technique is using Auth0 so you don't have to deploy a TVM and it works with all the APIs (S3, EC2, SQS, SES, etc.). Behind the scenes what we do is generating a SAML Token based on the user JSON Web Token and exchange that for AWS Temp Credentials using AssumeRoleWithSAML AWS API.
http://blog.auth0.com/2014/03/25/consume-aws-apis-from-the-b...