Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Decrypting Android Snapchat images

github.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Decrypting Android Snapchat images

#31

Post by cesarb »

quotemstr wrote: post #4

Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...". I'd have hoped that anyone dealing with AES and block cipher modes would take the task a bit more seriously, even if the whole task is, in this instance, ultimately futile due to the lack of a trust root.

> Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...".

And a class called "SlightySecurePreferences". One gets the feeling that the programmer responsible knew exactly what he was doing, but had been told to do it anyways.

Re: Decrypting Android Snapchat images

#32

Post by nmjohn »

userbinator wrote: post #27
splitbrain wrote: post #3

Earlier quoted context omitted.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

The real problem is that snapchat promises something it can not technically deliver. Once a photo leaves your phone and is delivered to somebody else, you lost control over that photo. It's precisely the same problem with DRM. You either lock down everyone's devices against their owners (a massive "do not want" situation) - and then you could still copy the data via the old-fashioned analogue hole (I'm not including…

> or accept the inevitable fact that data that can be accessed is data that can be copied.

I think this is something that is orders of magnitude easier for technophiles to accept than the average person.

Because to the average person it so so easy to delete data - they press the delete key and its gone! So they look at the problem and think the computer programmers just need to do a better job.

Whereas you or I realize that it virtually is impossible to prevent access of data - at least on a systemic level, and the problem (though in some cases it is the programmer's fault) isn't something that better programmers could fix.

Re: Decrypting Android Snapchat images

#34

Post by _asummers »

pennaMan wrote: post #14
splitbrain wrote: post #3

Earlier quoted context omitted.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

No matter how secure they store the photo, at the end the day a simple screenshot makes it all for nothing. It would be cool if Android had some API to disable screenshots.

I believe that SnapChat alerts the sender if a screenshot happened. While this doesn't prevent the action, obviously, it at least lets the sender know.

Re: Decrypting Android Snapchat images

#36

Post by tokenizerrr »

jszymborski wrote: post #33

I don't know much about the Android environment, and I get that regardless you're storing keys in a hostile environment, but would using the Android KeyChain to store the passwords instead work? https://developer.android.com/reference/android/security/Key...

Only available since ICS and can still be cracked open when the phone is rooted.

Re: Decrypting Android Snapchat images

#37

Post by fidotron »

The fundamental problem here is application security in situations of rooted devices is non-existent. Android lacks mechanisms for apps to tell they're running as root too (as the root user could disable this) so you can't disable functioning on rooted devices. (Chrome OS does not have this problem, as the official builds are signed by a single authority).

Newer Android versions have support for hardware DRM modules which would allow potential for some sort of nasty workaround (which may involve transcoding any images into movies), but in the general case for the wider market it's not going to work yet.

Finally, this is also why the NFC stuff is generally accompanied by another isolated system, though I seem to recall early versions of that (like in the Nexus S) proved to be sidesteppable.

Re: Decrypting Android Snapchat images

#38

Post by [deleted] »

fidotron wrote: post #37

The fundamental problem here is application security in situations of rooted devices is non-existent. Android lacks mechanisms for apps to tell they're running as root too (as the root user could disable this) so you can't disable functioning on rooted devices. (Chrome OS does not have this problem, as the official builds are signed by a single authority). Newer Android versions have support for hardware DRM modules…

[deleted]

Re: Decrypting Android Snapchat images

#39

Post by [deleted] »

cesarb wrote: post #31
quotemstr wrote: post #4

Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...". I'd have hoped that anyone dealing with AES and block cipher modes would take the task a bit more seriously, even if the whole task is, in this instance, ultimately futile due to the lack of a trust root.

> Nothing instills confidence in cryptographic code like the constants "bananas" and "seems legit...". And a class called "SlightySecurePreferences". One gets the feeling that the programmer responsible knew exactly what he was doing, but had been told to do it anyways.

[deleted]

Re: Decrypting Android Snapchat images

#40

Post by [deleted] »

readerrrr wrote: post #5
splitbrain wrote: post #3

Earlier quoted context omitted.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

They shouldn't store the images on the phone. You should be only able to view the image immediately after downloading it. After 10 seconds of viewing the image, everything gets deleted from ram.

[deleted]
Post reply on HN