The only "news" here is that you can MITM HTTPs when you own a trusted CA.
Of course you can break Snapchat if you can get users to install your CA cert. Snapchat is no different from every other application in that respect.
Show HN: Snapception – Intercept all snapchats received over the network
71–80 of 84 posts
Re: Show HN: Snapception – Intercept all snapchats received over the network
#72> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA Interesting, nevertheless, because it exposes that: > they use one, hardcoded key for all video and image encryption
Their point was, I believe, that you could store copies of all snaps sent to you without anything on your device which snapchat could "check" to see if it was being interfered with.
This has been reality for more than a year. In fact, i've been running a bot based off https://github.com/JorgenPhi/php-snapchat for the past 11 months.
it has over 5000 friends, and its popularity puts me to shame :(
Re: Show HN: Snapception – Intercept all snapchats received over the network
#73Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a scary-looking tool for intercepting the general stream of snaps (as it is made out to be).
Not necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our employees browsers through an ad-blocking proxy. Depending on your user base (kids?), it could be as simple as setting up an open wifi access point in a place where all other APs are password-locked. Edit: I just realized that this proxy requires the…
I've been using the same setup locally for years - ad-blocking/page-rewriting proxy to MITM the browsers on my machine and filter parts of pages that I don't want to even reach the browser.
If Snapchat required each user have a separate public/private keypair (which would be transferred through other means, maybe even in-person), like what SSH uses, then they would be less amenable to being MITM'd via a single centralised trusted authority.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#74quick heads up, on http://bradba.in under Technical skills > Web Frameworks you've put Node --- Node is NOT a framework it's a platform
Re: Show HN: Snapception – Intercept all snapchats received over the network
#75Earlier quoted context omitted.
Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
"Oh my GAWD MOM! YOU ALWAYS DO THIS! squeals hysterically"
Re: Show HN: Snapception – Intercept all snapchats received over the network
#76Snapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7e... To see why this is a problem, see the ECB-encrypted Tux image on http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#... Oops.
To protect in-flight data HTTPS encryption would be sufficient, since the attacker would have to MITM the connection and forge certificates instead of passively listening. But once it reaches the end device it is impossible for snapshat to deliver on its promises of ephemeral messaging. To display the data the device needs to be able to decrypt it. If it can be decrypted it can be copied. It's very much the same conc…
Was this relevant to the comment you replied to?
Re: Show HN: Snapception – Intercept all snapchats received over the network
#77There are trusted software client things (Spotify, Netflix, etc.) that seem to work well enough. Snapchat should be able to do better.
Totally different incentive. Spotify only needs protection that's enough of a pain the the ass to make it easier to just get the content from somewhere else or perhaps just pay the $n.99 for it.
Snapchat is full of (supposedly private) information that is not available anywhere else. Attackers will be far more determined.
Re: Show HN: Snapception – Intercept all snapchats received over the network
#78> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA Interesting, nevertheless, because it exposes that: > they use one, hardcoded key for all video and image encryption
Their point was, I believe, that you could store copies of all snaps sent to you without anything on your device which snapchat could "check" to see if it was being interfered with.
They could use certificate pinning [1] (and really, there is no reason for an app author not do so, except for the additional work) which would thwart all man-in-the-middle attacks. The end-point is still open through the analog gap (photograph of the screen) and custom clients, though.
[1] https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
Re: Show HN: Snapception – Intercept all snapchats received over the network
#79Re: Show HN: Snapception – Intercept all snapchats received over the network
#80There are trusted software client things (Spotify, Netflix, etc.) that seem to work well enough. Snapchat should be able to do better.
Totally different incentive. Spotify only needs protection that's enough of a pain the the ass to make it easier to just get the content from somewhere else or perhaps just pay the $n.99 for it. Snapchat is full of (supposedly private) information that is not available anywhere else. Attackers will be far more determined.
See links for a bit of reading about how hard it is to break DRM on Spotify or Netflix. They're doing a lot more than Snapchat. The difference between "you just need to reverse engineer the HTTP API to make a 3rd-party client" and "you need to run IDA Pro and PANDA and whatever else" is significant. The latter exploit would have far less reach.
[1] http://moyix.blogspot.de/2014/07/breaking-spotify-drm-with-p...