Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why can we still crack snapchat photos in 12 lines of Ruby?

security.stackexchange.com

Post reply on HN
Print view View original

31–38 of 38 posts

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#31

Post by 7952 »

gaius wrote: post #4
Stealth- wrote: post #2

I don't totally see the point to these arguments. The inherent nature of the technology we have means that if they can view it once, they can view it as long and as many times as they want. Anything trying to restrict that is just futile -- look at DRM. Snapchat has never given that particular illusion of privacy. As the most common and basic example, it has absolutely no way of stopping people from simply taking a s…

Actually it does attempt to do that - it requires you keep your finger on the screen while viewing so you can't perform whatever the screenshot command is. Which is lame but that's not the point - their selling point is that they do claim the images are transient. I'll wager 90% of their traffic is images people would not want made public, and some of it will be technically illegal.

The benefit to the user is that it establishes a social convention. You are unambiguously asking your friend not to share something around. It provides enough technical protection to prevent people sharing in the heat of the moment. In that sense it is like a changing room curtain.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#32

Post by eertami »

Stealth- wrote: post #2

I don't totally see the point to these arguments. The inherent nature of the technology we have means that if they can view it once, they can view it as long and as many times as they want. Anything trying to restrict that is just futile -- look at DRM. Snapchat has never given that particular illusion of privacy. As the most common and basic example, it has absolutely no way of stopping people from simply taking a s…

What the people who don't use Snapchat don't realize, is that you still have to trust someone if you're sending compromising photos. The benefit to Snapchat is that you don't have to worry about the recipients future negligence exposing them.

Snapchat is not a replacement for trust.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#33

Post by pbreit »

gaius wrote: post #4
Stealth- wrote: post #2

I don't totally see the point to these arguments. The inherent nature of the technology we have means that if they can view it once, they can view it as long and as many times as they want. Anything trying to restrict that is just futile -- look at DRM. Snapchat has never given that particular illusion of privacy. As the most common and basic example, it has absolutely no way of stopping people from simply taking a s…

Actually it does attempt to do that - it requires you keep your finger on the screen while viewing so you can't perform whatever the screenshot command is. Which is lame but that's not the point - their selling point is that they do claim the images are transient. I'll wager 90% of their traffic is images people would not want made public, and some of it will be technically illegal.

Not quite. The description on iTunes specifically notes that the receiver can take a screenshot: https://itunes.apple.com/us/app/snapchat/id447188370?mt=8

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#34

Post by mrinterweb »

I did not know about the "strings" command. I'm sure that there are plenty of binaries containing secret keys. I would assume that one way to protect against the easy prying ability of strings would be to use an integer array representing chars used to concatinate a string, but that does seem kind of hacky.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#35

Post by Retric »

BWStearns wrote: post #8

This is a bit of a tangent, but I think it get's at the more interesting part of this question. I ended up following a link to another sec.se thread where the idea of secure program obfuscation was discussed.[0] I feel embarrassed for having missed this but it appears that there exists on a theoretical level a manner of solving snapchat's woes. The wired article ([0][0]) seems to suggest that it would be impractical…

Not really, if the program looks sufficiently random it's probably malware. Don't forget false positives are ok as long as the user can decide to allow things to pass you can also flag programs as ok just as easily as you can flag them as malware.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#37

Post by Stealth- »

nodata wrote: post #7
Stealth- wrote: post #2

I don't totally see the point to these arguments. The inherent nature of the technology we have means that if they can view it once, they can view it as long and as many times as they want. Anything trying to restrict that is just futile -- look at DRM. Snapchat has never given that particular illusion of privacy. As the most common and basic example, it has absolutely no way of stopping people from simply taking a s…

Actually an Android app can disable screenshots, but your point still stands: there is nothing to stop someone taking a photo of the screen.

It can, but they explicitly choose not to in Snapchat, afaik.

Re: Why can we still crack snapchat photos in 12 lines of Ruby?

#38

Post by ZoFreX »

habosa wrote: post #29
ZoFreX wrote: post #18

I don't fully understand this issue. I understand that you are never going to be able to stop the intended recipient keeping the image - that's trivial just with a screenshot, and anyone even capable / caring enough to run the linked code is going to defeat any further obfuscation you pile on. What isn't clear to me from the link is: Is this same encryption the only protection applied to "snaps" that are in-flight? I…

Yes the same encryption is on in-flight snaps. You could absolutely set up something like that.

Well that's just awful.
Post reply on HN