Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Snapception – Intercept all snapchats received over the network

github.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: Show HN: Snapception – Intercept all snapchats received over the network

#61

Post by downandout »

chrissnell wrote: post #51
downandout wrote: post #44

Earlier quoted context omitted.

That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.

Good point, but it's an interesting idea. An open-source home firewall that's designed with features/sniffers that lets parents keep an eye on their kids' online usage.

I was thinking the same thing. Call it Kidsafe or something. Make it automatically configure the router and let parents access the info online. Most phones are programmed to use wifi at home - seems like a promising opportunity.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#62

Post by teacup50 »

primitivesuave wrote: post #4

Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a scary-looking tool for intercepting the general stream of snaps (as it is made out to be).

Remember the iOS SSL bug from just this year that resulted in a complete bypass of x509 certificate trust validation?

Re: Show HN: Snapception – Intercept all snapchats received over the network

#63

Post by e12e »

ne0n wrote: post #57
enimodas wrote: post #40

But snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt You will need the android id of the phone, which I don't think you can easily get as a man in the middle?

What do the android ids look like? I'm assuming it's just a number, but I don't know how big. The page you linked to says the key is md5(android_id + "seems legit..."). It seems to me like this could potentially be brute forced to find the android_id using a captured encrypted image.

Except for versions 2.2, it appears to be a random 64bit integer:

http://developer.android.com/reference/android/provider/Sett...

That would take some time to brute force I guess. Especially if the only way to check each guess is to try and decrypt and look for a valid (part of an) image header.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#64

Post by e12e »

enimodas wrote: post #40

But snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt You will need the android id of the phone, which I don't think you can easily get as a man in the middle?

Well, that's for the encryption key of the images stored on the device. But if you can MITM the connection, then you can get the images as they come from snapchat to the device? And either the device have to send the id up, so the server can encrypt the images with a shared secret (perhaps the id is sent when the app is installed?) -- or the images are sent, encrypted with a different key, then re-encrypted for storage on the device?

Re: Show HN: Snapception – Intercept all snapchats received over the network

#65

Post by logn »

icelancer wrote: post #26
droopybuns wrote: post #10

Snapchat's supposed valuation at $10b while they appear to be completely inattentive to the security of their product is hard to reconcile.

It is? Startups are taught to move fast and break things. Security usually requires to be thoughtful and not intentionally ruin stuff. Runs counter to the whole new modern movement.

Their selling point is that the snaps are ephemeral. I don't think anyone's expecting fool-proof security, but the overall impression is that the privacy aspect is all just marketing hype. It's not that big of a deal but then again it's not a big deal to switch to the next messenger app either.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#66

Post by lotsofmangos »

icelancer wrote: post #26
droopybuns wrote: post #10

Snapchat's supposed valuation at $10b while they appear to be completely inattentive to the security of their product is hard to reconcile.

It is? Startups are taught to move fast and break things. Security usually requires to be thoughtful and not intentionally ruin stuff. Runs counter to the whole new modern movement.

I didn't think that facebook policy was industry policy.

Besides I always though that sounded like a bad idea as an aim, it is more just an observation of one of the common consequences of moving fast, which probably should be looked at and reduced by having some extra members of staff dedicated to breaking less things, so that moving fast doesn't get too expensive.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#67

Post by [deleted] »

elwell wrote: post #2

> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA Interesting, nevertheless, because it exposes that: > they use one, hardcoded key for all video and image encryption

[deleted]

Re: Show HN: Snapception – Intercept all snapchats received over the network

#68

Post by iancarroll »

maccard wrote: post #48
brazzledazzle wrote: post #33

Earlier quoted context omitted.

Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.

Have you met a teenager? They will blindly just click ignore/ok until they can do what they want. an invalid cert error isn't going to stop them unless it actually blocks (rather than warns and lets them proceed)

Pretty sure you can't hit OK on this one, it'll just hard fail.

Re: Show HN: Snapception – Intercept all snapchats received over the network

#69

Post by asdfaoeu »

ChuckMcM wrote: post #36
elwell wrote: post #2

> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA Interesting, nevertheless, because it exposes that: > they use one, hardcoded key for all video and image encryption

Their point was, I believe, that you could store copies of all snaps sent to you without anything on your device which snapchat could "check" to see if it was being interfered with.

So? Everyone should know that. Just get a camera?

Re: Show HN: Snapception – Intercept all snapchats received over the network

#70

Post by the8472 »

tomfitz wrote: post #35

Snapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7e... To see why this is a problem, see the ECB-encrypted Tux image on http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#... Oops.

To protect in-flight data HTTPS encryption would be sufficient, since the attacker would have to MITM the connection and forge certificates instead of passively listening.

But once it reaches the end device it is impossible for snapshat to deliver on its promises of ephemeral messaging. To display the data the device needs to be able to decrypt it. If it can be decrypted it can be copied.

It's very much the same conceptual impossibility that DRM faces.

So in the end it doesn't really matter whether it's ECB or something better. It remains a DRM scheme.

Post reply on HN