Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Decrypting Android Snapchat images

github.com

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Decrypting Android Snapchat images

#11

Post by JoachimSchipper »

readerrrr wrote: post #9
johsoe wrote: post #6

Earlier quoted context omitted.

Then you have to wait for the download every time you open the app. This is an okay compromise tbh. (They could offer a super secure option or whatever, I guess)

Actually you could just download the encrypted images without the unique key( for every image ) and then get the key on demand. Load the image into ram, decrypt, show the image and then erase everything.

That would be more secure, but you still need to wait for the key to be downloaded on-demand - you don't exactly get butter-smooth scrolling that way.

(I like security.)

Re: Decrypting Android Snapchat images

#13

Post by readerrrr »

JoachimSchipper wrote: post #11
readerrrr wrote: post #9

Earlier quoted context omitted.

Actually you could just download the encrypted images without the unique key( for every image ) and then get the key on demand. Load the image into ram, decrypt, show the image and then erase everything.

That would be more secure, but you still need to wait for the key to be downloaded on-demand - you don't exactly get butter-smooth scrolling that way. (I like security.)

And you would have to be connected to the internet. That is a problem. The delay could be hidden behind a ui.

Re: Decrypting Android Snapchat images

#14

Post by pennaMan »

splitbrain wrote: post #3
espadrine wrote: post #2

> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'. That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

No matter how secure they store the photo, at the end the day a simple screenshot makes it all for nothing. It would be cool if Android had some API to disable screenshots.

Re: Decrypting Android Snapchat images

#15

Post by [deleted] »

splitbrain wrote: post #3
espadrine wrote: post #2

> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'. That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

[deleted]

Re: Decrypting Android Snapchat images

#17

Post by laurencei »

pennaMan wrote: post #14
splitbrain wrote: post #3

Earlier quoted context omitted.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

No matter how secure they store the photo, at the end the day a simple screenshot makes it all for nothing. It would be cool if Android had some API to disable screenshots.

And then people will just have a second phone (or camera) and take a 'photo' of the original screen itself.

Re: Decrypting Android Snapchat images

#18

Post by higherpurpose »

If Snapchat is serious about its users' private messages, it should be implementing the Axolotl protocol for end-to-end encryption (what TextSecure uses, too). But Snapchat isn't serious about it, as we've seen in several securiy/privacy scandals involving the company so far, so I'm not going to hold my breath for this.

https://whispersystems.org/blog/advanced-ratcheting/

Pro tip for future chat app start-ups promising "security" or "privacy" or as the latest trend goes, "anonymity" for their users. If you can't really hold your end of the bargain, don't do it! Promise cute emoticons or whatever, instead. Hopefully there will be some class action lawsuits against companies like Snapchat, soon. They need to learn their lesson.

Re: Decrypting Android Snapchat images

#19

Post by AlyssaRowan »

espadrine wrote: post #2

> The key is generated from an MD5 hash using the Android ID concatenated to the string 'seems legit...'. That is a stellar decision. I wonder if there were application-specific constraints that prevented a more secure option.

That sounds to me like the sound of doomed, screaming programmer.

Yes, this is all exactly as bad as you think it is. Yes, you did just read ECB. Snapchat clearly isn't even trying to be secure.

Re: Decrypting Android Snapchat images

#20

Post by wellboy »

How a company with $163M in funding is not able to put just a normal encryption into their app or hire someone who knows about encryption is out of my comprehension.

We implemented a standard Blowfish encryption in university at a small project on the side and it was better than that.

I'm by no means a cryptography expert, but you don't store keys on the device, they are generated dynamically. Storing them in a directory that seems like an unimportant directory is the most amateur mistake of trying to increase security, as it adds zero security.

Post reply on HN