Decrypting Android Snapchat images • Hacker News Board

Re: Decrypting Android Snapchat images

#61

Post by wellboy » Sat, Oct 11, 2014, 9:52 PM UTC

Erwin wrote: post #30

wellboy wrote: post #20

How a company with $163M in funding is not able to put just a normal encryption into their app or hire someone who knows about encryption is out of my comprehension. We implemented a standard Blowfish encryption in university at a small project on the side and it was better than that. I'm by no means a cryptography expert, but you don't store keys on the device, they are generated dynamically. Storing them in a direc…

Enlightens on then on how you would solve the issue. You have a program, and the program is storing data and the "attacker" (here really the user himself) wants to bypass the policies enforced by the application. The attacker has access to both the binary of the app and the data. What would you encrypt the data with that the user himself cannot also access? Without a secure encryption hardware module, there's little…

I'm not sure as no system is 100% secure. It's only a matter of how high you want to set the bar, but this bar is very low imho.

Re: Decrypting Android Snapchat images

#62

Post by e12e » Sat, Oct 11, 2014, 10:56 PM UTC

pennaMan wrote: post #14

splitbrain wrote: post #3

Earlier quoted context omitted.

In the end the application needs a key to decrypt the storage. That key has to be stored somewhere on the device. On a rooted phone there is no place out of reach, so all they can do is make the storage obscure. Unless the hardware provides some inaccessible secure thingy there's not much they can do... I guess even if it did a script like that could access the secure thingy via USB debug as well. I don't think the d…

No matter how secure they store the photo, at the end the day a simple screenshot makes it all for nothing. It would be cool if Android had some API to disable screenshots.

Or, you could take a photo of the screen, if you wanted to save images you already have access to (something snapchat is supposed to prevent). The good old analog hole.

Re: Decrypting Android Snapchat images

#63

Post by quotemstr » Sun, Oct 12, 2014, 1:55 AM UTC

tjbiddle wrote: post #41

[deleted] wrote: post #39

Earlier quoted context omitted.

[deleted]

Well, prior - there were apps you could download that would save Snapchat images that would work on non-root devices. At least by enabling this encryption that's now only available to the relatively small amount of root users out there.

Or anyone who can use adb backup. If you view the physical possessor of a device as your adversary, you're bound to lose.

Re: Decrypting Android Snapchat images

#64

Post by [deleted] » Sun, Oct 12, 2014, 2:01 AM UTC

roywiggins wrote: post #59

cortesoft wrote: post #54

Earlier quoted context omitted.

If you look at the link, even the current method requires root on the device.

I was thinking about Bad Apps that users voluntarily hand their login details to (so they can download snapchats they get sent). Those don't need root, since they're just mimicking the Snapchat app and receiving the photos directly. But it doesn't work, since you need some way to generate new API keys for your second device... which could be a Bad App. If you 1) enforce one key at at time (so one "device" at a time),…

[deleted]

Re: Decrypting Android Snapchat images

#65

Post by mindslight » Sun, Oct 12, 2014, 2:01 AM UTC

fidotron wrote: post #37

The fundamental problem here is application security in situations of rooted devices is non-existent. Android lacks mechanisms for apps to tell they're running as root too (as the root user could disable this) so you can't disable functioning on rooted devices. (Chrome OS does not have this problem, as the official builds are signed by a single authority). Newer Android versions have support for hardware DRM modules…

> Android lacks mechanisms for apps to tell they're running as root too (as the root user could disable this) so [apps] can't disable functioning on rooted devices

As the owner of the device (ie the one who should have ultimate control over it), this is precisely what I want. It would be horribly broken for an operating system to do anything else!

That we're not only still fighting the battle for personal computing but additionally having to defend against misguided ideas from people in supposedly technical communities is ridiculous.