161–170 of 291 posts
Earlier quoted context omitted.
>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.
[flagged]
Earlier quoted context omitted.
This is stopped by certificate transparency logs. Your software should refuse to accept a certificate which hasn’t been logged in the transparency logs, and if a rogue CA issues a fraudulent certificate, it will be detected.
I don't believe it's supposed to proactively check the logs as that would inevitably break in the presence of properly configured MITM middleboxes which are present on many (most?) corporate networks. The point of the logs as I understand it is to surface events involving official CAs after the fact.
Earlier quoted context omitted.
An MDM orga cannot install a trusted CA on non-supervised (company owned) devices. By default on BYOD these are untrusted and require manual trust. It also cannot see everything on your device - certainly not your email, notes or files, or app data.
As someone who has an MDM-managed device, I beg to differ. Although, this one uses newer style android MDM, which involves factory resetting and doing special things during OOBE. Even if it used the older style, nothing's stopping the app for requesting file access, notification access, etc. and not working until you grant the permissions.
Earlier quoted context omitted.
Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?
Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` Bootstrap demo https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst... " rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZq…
You don't do this in any non-trivial system.
A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a co…
The permissions snippet they show also doesn't include location, and you can't request location at runtime at all without declaring it there. I'd verify all this stuff for myself, but Play won't install it in my phone so I can't really get the APK. Maybe because I use Graphene...? but I don't know all the ways they can restrict it, maybe it's something else (though for a pixel 9a it's rather strange if it's hardware…
A bit skeptical of how this article is written as it seems to be mostly written by AI. Out of curiosity, I downloaded the app and it doesn't request location permissions anywhere, despite the claims in the article. I've noticed Claude Code is happy to decompile APKs for you but isn't very good at doing reachability analysis or figuring out complex control flows. It will treat completely dead code as important as a co…
>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.
Earlier quoted context omitted.
Completely agree. This is really unique. Can you imagine if it were standard practice to be open to supply chain attacks like that, by blindly relying on hotlinked or unpinned dependencies?
Why imagine? Let's take a quick look at what's actually happening right now. We can check some widely used libraries and see what their instructions are teaching new developers. Boostrap (code snippet from their quick start instructions): ``` Bootstrap demo https://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/css/bootst... " rel="stylesheet" integrity="sha384-sRIl4kxILFvY47J16cr9ZwB07vP4J8+LH7qKQnuqkuIAvNWLzeN8tE5YBujZq…
I'd bet something like 70+% of all JS apps are inadequately protected against the risk of a malicious actor gaining access to a dependency's repo.
Pearlclutching over this while ignoring the lessons of `left-pad` and `colors` is biased motivated reasoning at best.
Earlier quoted context omitted.
>as it seems to be mostly written by AI. Is there something in particular that made you conclude that or are you going just with how it felt? For what it's worth, it didn't seem to me.
Perhaps the apparent hallucination they mentioned in their comment?
So, no. Not a "hallucination".
[0] https://documentation.onesignal.com/docs/en/location-opt-in-...
Earlier quoted context omitted.
I don't believe it's supposed to proactively check the logs as that would inevitably break in the presence of properly configured MITM middleboxes which are present on many (most?) corporate networks. The point of the logs as I understand it is to surface events involving official CAs after the fact.
Corporate machines would have the proper certs pushed to them for the MITM box to work though - would that affect this ?