5 ms·
Currently discussing with friends best way to crack it and make it seem like there's a rare pokemon just up ahead - for all those people who slowly clog up the
by jmadsen 10y ago
Currently discussing with friends best way to crack it and make it seem like there's a rare pokemon just up ahead - for all those people who slowly clog up the sidewalks and stations staring at their phones.
Ideas welcome!
(For the official record, since you have to say this these days - I'm only joking)
- abstractbeliefs 10y agoIt's already been noted that the application itself doesn't verify the validity of TLS certs, so it's trivial to MITM the connection and there are currently people working to learn the ins and outs of the API.
- Dylan16807 10y agoIt verifies certs, it just doesn't pin them. So if you can hack your phone, you can hack it, shocker. Not a security flaw.
- chatmasta 10y agoAnd if you can hack your phone, you can disable pinning.
- cocotino 10y agoNo need to hack anything, just install your own cert
- bognition 10y agoCurious why you don't think this is a security flaw. Surely a browser failing to pin certificates would be a bad thing, no?
- wepple 10y agobrowsers generally don't pin certs. there are methods to do it but everyone is scared to do it as it's a pretty quick way to DoS your entire user-base if you get it wrong. The intended design of PKI suggests that pinning should not be a thing. unfortunately PKI is broken and pinning is a 'patch' because it's too each to obtain a cert for a property you don't own (hi bluecoat)
- darklajid 10y agoThere are legitimate reasons to extend the trusted root certificates (notably: corporate deployments). Admitted, I cannot come up with a reason that has anything to do with Pokemon, but - in general I think this should be possible. Plus: Who do you want to protect and from whom? The only person able to make Pokemon Go (locally, on their phone) accept another certificate is by having full access to the phone in the first place. It's the user, 'hacking' his own device. If this leads to exploits on the Pokemon Go server for some reason, than _those_ are the problems. The communication between app and Pokemon Go server uses TLS, even if I spoof a certificate for my very own device. For me this is one of the examples of Raymond Chen's "If you're already on the other side of the hatch it isn't a security exploit", but I might absolutely fail to understand the risks of course.
- bognition 10y agowow, thanks for the reply. Although i'm not sure why my question was downvoted...
- ionwake 10y agoHas anyone made any progress ?
- nathancahill 10y agohttps://www.reddit.com/r/jailbreak/comments/4s6rx7/discussion_pokemon_go_megathread/ https://www.reddit.com/r/jailbreak/comments/4s6rx7/discussio...
- ionwake 10y agoThanks!
- netcraft 10y agoim not interested in hacking or modifying things, but would love to get api access to the data - can you link to a forum where this stuff is being worked on?
- Erwin 10y agoThe first pokecrime has already been committed -- criminals placed a "lure" in the middle of a night in a secluded space, and robbed teens that showed up there at 2am: http://www.usatoday.com/story/tech/2016/07/10/four-suspects-arrested-string-pokemon-go-related-armed-robberies/86922474/ http://www.usatoday.com/story/tech/2016/07/10/four-suspects-...
- mikeash 10y agoYesterday I was browsing pictures of huge groups of players staring at their phones in public areas and thought, wow, what a perfect opportunity for criminals to steal some phones. I am totally not shocked at this news.