Tag Info

New answers tagged

0

There are plenty android applications in the market. I am using K9 with APG (Android Privacy Guard) and I am very pleased. K-9 Mail is a free and open source email client for Android devices, that integrates seamlessly with Android Privacy Guard. Android Privacy Guard (APG) is a free and open source application that lets you encrypt, decrypt and sign ...


1

Java servers and Android apps expect the public key in X.509 format, see http://blog.wingsofhermes.org/?p=42 on how to convert.


1

To get randomness, you must obtain sufficient initial entropy from some "really random" events, that come from physical systems. Once you have sufficient initial entropy, you can extend it indefinitely with a cryptographically secure PRNG. The PRNG being a deterministic process, its output is not impacted by whatever other process may run at the same time on ...


0

Cryptographically secure random number generators are deterministic mathematical processes for given arguments, and do not care about the factors that having running programs affects - i.e. the kernel state and the data stored in RAM. There is no reason that other programs would affect the operation of these generators.


1

What you're suggesting is completely compatible with the Android TLS framework. When you create a connection to a remote server, you can specify your own trusted CA list. This means that instead of using the default CA store trusted by the OS, for this connection you trust only certificates signed by the CAs you specify, which don't need to be known to ...


1

You're overcomplicating things and reducing security for no reason. Do use SSL¹ — why on earth would you not use it? The whole point of SSL is to avoid MitM attacks. If I understand your protocol correctly: When the application is installed, it sets up a per-device secret key which it shares with the server. You haven't said how — are you going to use SSL ...


1

What you are asking is basically redefining the "common SSL". However, you are basing trust on the server only, whereas in SSL the trust is delegated to a third party. Moreover, in SSL certificates are signed, therefore you can verify their authenticity. So yes, the scenario will be able to prevent MitM attack (in a way), but the user loses some trust in ...


0

Any system can be compromised if not used carefully. As others have said, if the phone is rooted and apps are installed that do contain exploits then a risk exists for information to be captured from the various interfaces on the device because the device itself can no longer be "trusted." Some apps can contain malware and viruses such as the free ...


-3

Windows 7/8/8.1 will be massively safer than android as they still get security updates from microsoft, android is a complete mess for security, there is a few problems. 1 - google do not support android for very long, a recent exploit they announced wont be patched in 4.3 and older, 4.3 was not even 12 months old when they announced this. Microsoft ...


3

You've answered the question yourself. You're trying to implement DRM to prevent users from getting the video off the device. In practice there is little you can do to prevent this. There will always be ways to copy the stream, even intercepting the stream (it has to be displayed on the device at some point right?). So the only thing you can do is make it ...


0

Broadly, the design of Unix-like operating systems (in particular Linux, on which Android is based, and Mac OS X) means the OS is by design the only software entity that's allowed to communicate with the SIM. (I say 'software' because other hardware isn't quite so limited.) So I don't think this is something you need to worry about. Or, phrased another way: ...


3

To give the good answer from thexacre a broader touch: If the application itself does the certificate checking correctly (not all do, see http://www.kb.cert.org/vuls/id/582497) then an MITM attack is only possible if the attacker is somehow trusted by the owner of the device. In case of an owner which is curious what the application does the attacker is the ...


18

That app (and all MITM proxy apps such as SandroProxy and mitmproxy) work by installing their own trusted CA certificate on the device. That allows them to sign their own certificates which the device will accept. You have to manually install their certificate to the user key-store using a dialogue such as this: After which it displays warnings such as ...


1

While your phone is connected to the Wifi it will be subject to DHCP requests in order to maintain a connection. So while your mobile device is connected to the router it will periodically send & receive ARP packets. It is likely that it would also respond to other simple requests, such as ping from other devices, network discovery from other machines ...


0

Most programs that constantly check for updates will check in the background over wifi even if the application is not open. Applications such as facebook messenger do this often to get near realtime updates.


1

Might be a dup, see this answer: http://android.stackexchange.com/questions/6541/can-a-factory-reset-fix-malware-problem. The short answer is that factory reset may not be enough to unroot your system if it has been rooted.


0

Any proper use of encryption will not store the key in a config file. While a hash might be stored, it's one way, so knowing the hash will not allow for recovery of the password, only that the entered password's hash matches the stored hash, and therefore the proper password was entered. You will need to use the original app as it most likely uses a ...



Top 50 recent answers are included