Cracking Meta's Messenger Certificate Pinning on macOS

Post by out-of-ideas » Wed, Mar 06, 2024, 9:04 AM UTC

vengefulduck wrote: post #60

bevekspldnw wrote: post #12

Earlier quoted context omitted.

Ok, that makes sense! Sometimes when you read a blog post that is well written and cogent it makes it feel like the author did it in 20 min! If I end up in the same arena I think I’ll look for debugging code next. I love certificate pinning as a user, but as a forensic analyst I fucking loath it.

Even as a user I don’t there’s a good reason to love cert pinning. If you’re going up against adversaries that can compromise web pki they also probably have some other exploits up their sleeve to pwn you. Cert pinning pretty much serves to protect companies from people reversing their protocols and little else imo.

Post by fullspectrumdev » Wed, Mar 06, 2024, 9:07 AM UTC

thaumasiotes wrote: post #99

callalex wrote: post #66

Earlier quoted context omitted.

Snapchat’s founding principle and only differentiator from day one has been untrusted client security. There were way too many years where the general public believed that a Snapchat could not be saved. I give huge credit to Snapchat for accidentally teaching the public that if human eyeballs can see something, it can be recorded forever. Now that is taken for granted, even last week’s Saturday Night Live TV sketch r…

What? That wasn't a principle of theirs. They explicitly exclude "screenshot detection avoidance" from their bug bounty policy: https://hackerone.com/snapchat?type=team . They always have. As far as they're concerned, that's not a security issue.

Post by actionfromafar » Wed, Mar 06, 2024, 9:55 AM UTC

simonw wrote: post #59

hunter2_ wrote: post #52

Earlier quoted context omitted.

My hypothesis is that it's not listening nor is it predicting based on the individual, instead it's reacting to web surfing behaviors of your associates. For example, you and your partner use the same wifi at home a lot, and you both visit a close friend's house and use their wifi every time you're there. Services that you use in both places (e.g. Facebook, Google) now have a graph where there's a very strong link be…

My theory is that we're all just WAY less interesting than we think we are. Male, 40+? A bit more likely than the average human to have a mini mid-life crisis and decide to buy an electric guitar. These platforms suggest SO many ads to us that even if 99% of the suggestions are total junk that we ignore without even registering, the 1% that represent a lucky roll of the dice still really stick in our memories.

Post by justin101 » Wed, Mar 06, 2024, 10:28 AM UTC

Post by scoot » Wed, Mar 06, 2024, 10:40 AM UTC

justin101 wrote: post #107

I am curious about the legality of this. I guess I assumed that doing this type of thing would technically a DCMA type breech? So this makes me wonder if my assumption wrong? How does this work legally?