Decrypting Android Snapchat images
github.com
Decrypting Android Snapchat images
1–10 of 65 posts
Re: Decrypting Android Snapchat images
#2> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'.
That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.
Re: Decrypting Android Snapchat images
#3> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'. That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well.
I don't think the developers are to blame. They did what they could.
The real problem is that snapchat promises something it can not technically deliver. Once a photo leaves your phone and is delivered to somebody else, you lost control over that photo.
Re: Decrypting Android Snapchat images
#4Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...". I'd have hoped that anyone dealing with AES and block cipher modes would take the task a bit more seriously, even if the whole task is, in this instance, ultimately futile due to the lack of a trust root.
Re: Decrypting Android Snapchat images
#5> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'. That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…
They shouldn't store the images on the phone. You should be only able to view the image immediately after downloading it. After 10 seconds of viewing the image, everything gets deleted from ram.
Re: Decrypting Android Snapchat images
#6Earlier quoted context omitted.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…
They shouldn't store the images on the phone. You should be only able to view the image immediately after downloading it. After 10 seconds of viewing the image, everything gets deleted from ram.
Then you have to wait for the download every time you open the app.
This is an okay compromise tbh.
(They could offer a super secure option or whatever, I guess)
Re: Decrypting Android Snapchat images
#7Earlier quoted context omitted.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…
They shouldn't store the images on the phone. You should be only able to view the image immediately after downloading it. After 10 seconds of viewing the image, everything gets deleted from ram.
I wonder why they didn't choose this path. A trade off for better usability ? Why would an app break it's core promise to offer better usability ?
Re: Decrypting Android Snapchat images
#8Earlier quoted context omitted.
In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…
They shouldn't store the images on the phone. You should be only able to view the image immediately after downloading it. After 10 seconds of viewing the image, everything gets deleted from ram.
It's also not difficult to bypass the app completely and poll the service from another program (for instance, run by cron on a server). Like other people have said, the entire premise is flawed.
Re: Decrypting Android Snapchat images
#9Earlier quoted context omitted.
They shouldn't store the images on the phone. You should be only able to view the image immediately after downloading it. After 10 seconds of viewing the image, everything gets deleted from ram.
Then you have to wait for the download every time you open the app. This is an okay compromise tbh. (They could offer a super secure option or whatever, I guess)
Actually you could just download the encrypted images without the unique key( for every image ) and then get the key on demand. Load the image into ram, decrypt, show the image and then erase everything.
Re: Decrypting Android Snapchat images
#10Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...". I'd have hoped that anyone dealing with AES and block cipher modes would take the task a bit more seriously, even if the whole task is, in this instance, ultimately futile due to the lack of a trust root.
As you point out, the task is futile; I'd be inclined to have a higher opinion of an engineer that realized this.
It's not exactly good marketing, though.