Tag Info

New answers tagged

0

Android uses AccountManager to store the passwords. By rooting a phone you can access the encrypted store. What happends now depends on the password you use to lock your phone (from which is derived the encryption key for the store). As you can imagine, a 4 digits PIN is not going to resist long. A fingerprint (or other mechanism with large entropy) will ...


0

I don't know how the audio playing is done on the device, but if an external application outside chrome is used for download the content, then the problem might be the use of SNI (Server Name Indication). Some Android applications still have problems with SNI, especially if they where built with Apaches HTTP client library. But, your site requires SNI. That ...


-1

There are highly sensitive spywares out there that can be bought online, which only require your Bluetooth to upload. Also, there are spyware softwares that can be uploaded by phone calls, texts and email attachments. There are also apps that can figure out passwords in the same manner as a phone-auto-redial. All of these softwares are available online and ...


0

Yes, and in fact there is such a password manager, that uses gpg for the encryption. It's called pass, and it's available at http://www.passwordstore.org/ for linux/Unix. With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be ...


2

Ask, and it shall be delivered: https://developer.android.com/reference/android/Manifest.permission.html All items on this very large list are arguments to <uses-permission> in the Android Manifest. It would also be helpful to read these as well: How permissions are used by the Android system: At application install time, permissions requested ...


1

The SuperUser app acts as a gateway to running things as root, which should prevent apps from becoming root directly without your approval. However, if an app you approve to run as root has a vulnerability, a malicious app might be able to exploit it to gain root. Other security concerns include: Taking advantage of the more lax side-loading abilities ...


1

The important thing to keep in mind is that the actual encryption keys for the volume are stored in the Trusted Execution Environment (TEE) chip, which is designed to provide secure key storage. The goal of the device is to act as an encryption oracle: you give it some data, it encrypts or decrypts it, then gives you the result. This means that if you take ...


1

WebView can also be exploited by malicious websites as there's no way to know if a site has been labeled as malware or phishing. And most of the time, developers don't display the URL so end-users can't even check to see if the site is what they think it is. We've just launched a Security API to address this problem ...


2

Firstly, in iOS you can deny access to certain resources (when they're first requested by an App you receive a popup you can either accept or reject) and therefore Apps are designed to handle the scenario of access being rejected. You can also disable Internet access on an App by App basis, although you're not explicitly asked this ahead of time. Overall ...


3

Does Android KitKat and later have sufficient default sandboxing to prevent malware from doing any harm How long is a piece of string? Ensuring confidentiality isn't the only goal of information security, if the App was to run a background service that constantly consumed significant CPU with the goal of draining your battery would that be a threat? ...


8

Each version of Android is incrementally stronger on this front than the previous, and Lolipop certainly pushes application sandboxing a step further than Kitkat, particularly with respect to inter-app isolation. Third-party "firewall" apps on Android are probably a bit over-hyped, and the level of protection they can offer without rooting is in my opinion ...


1

The app will keep user credentials (login and password) encrypted in a local database. I'm not sure which encryption scheme to use though. Don't encrypt the password, hash it. Ideally using something like bcrypt. I'm considering either a long duration multi-use token or short duration one-time tokens. The shorter the better, in order to reduce ...


1

Simply use SandroProxy (on-device) or mitmproxy (off-device), these will help you perform a MITM attack by generating valid certificates on the fly. Then use your root permissions to install the CA certificate for your MITM proxy to the system key store (which is located somewhere like /data/misc/keystore from memory) which will avoid the usual warning you ...


0

The Google Maps SDK for iOS sends the app's API key to Google in such a way that any end user of the app can find the app's API key by using an HTTPS proxy. If you happen to be developing on a Mac, you can try this yourself pretty easily using the Charles proxy. Configure Charles to act as a proxy for clients4.google.com. On a Mac you'll need to make ...


1

I think the following four approaches more or less cover all possibilities for what could be done: Use an expensive (in terms of CPU time) key derivation function. However slowing down the attacker by any factor this way will slow down legitimate attacks by the same factor. And realistically the attacker will be able to use more CPU power than is present ...


47

Chip-based banking cards typically use a 4-digit PIN. It would take at most a few hours to try them all if the card didn't protect against brute force attempts. The card protects against brute force attempts by bricking itself after 3 consecutive failures. The adversary does not have access to a hash of the PIN (there are physical protections in the card ...


2

Generation of a key and use of a pass-phrase is two different things. Keys, for example in asymmetric cryptography, are generated using entropy coming from the computer environment (like /dev/urandom, which might or might not be a good entropy source, but that's another debate). So the key itself has nothing to do about the pass-phrase. The pass-phrase will ...


2

I don't know if this is how Android does it, but a hardware-backed secure storage device can block repeated attempts that are made too quickly, making your assumption of 0.1 guesses per second invalid. Suppose it initially allows one attempt every 0.01 of a second, but it doubles the time between attempts with each failure after the first five. After a mere ...


2

The play store uses SSL/TLS to ensure the integrity of your downloads, just like your web browser. Basically it downloads metadata for a particular package including a plain HTTP URL and a checksum of the binary. After the download it compares the checksum to the APK and ensures they match. how can trust that I'm securely communicating to download and ...



Top 50 recent answers are included