4 ms·

The problem with this is that the more places that need a photocopy of your government id the more leaks are going to have photo ids in them. In the long run it

The problem with this is that the more places that need a photocopy of your government id the more leaks are going to have photo ids in them. In the long run it won't work.

adrr 8y ago
It's an easy problem to solve. Force people to signup through app and make them take pictures of their documents. You can safeguard against all but state-sponsored attacks by simply obscuring your device oauth key and rotating it frequently through app updates, detecting emulation/simulator, pinging E911 location of the phone via the carrier. Look at how hard the Starbucks app is to crack open and get access to the remote APIs or how long Skype protected their protocol. Can easily put the same amount of effort to ensure that phone isn't tampered with and that you're getting a legitimate picture of the docs.
- c4h8o3del 8y ago
  > Force people to signup through app > Can easily put the same amount of effort to ensure that phone isn't tampered with You put a proprietary app on your phone. You presumably did this for other "secure" companies too. You no longer have a way to know who did or didn't tamper with it.
  - adrr 8y ago
    Skype managed to do it for a communication app. Games do it all the time to prevents bots. How many AIMbots are there for on secured platform like PS4 or Xbox? There's none because its next to possible to do. The fact that your running on phone makes it harder for hackers since there is way more sensor data you have fake and you have to take the carrier stuff because carriers allow you poll devices for things like E911 location. You easily detect if you're running on a simulator and most modern financial apps have this protection. How are you going to hook up a debugger on IOS device? There isn't a jailbreak for the current OS. Setup cert pinning on the app and you won't be able to even install your own trusted cert to look at the TLS traffic.
    - dekimir 8y ago
      Is there a good writeup somewhere on how the phone apps you mentioned prevent tampering? I'd be super-interested in reading it. Alternatively, are you available for consulting on the topic? I couldn't find any contact info in your profile. :(
      - adrr 8y ago
        Caveat: I am not a security expert by any means. Starbucks app security is a good starter and easy to implement their strategies in an existing app. If you add in IOS version checking, you can help mitigate the risk of getting attacked by a jailbroken device on an older version of IOS. https://blog.tendigi.com/starbucks-should-really-make-their-apis-public-6b64a1c2e923 https://blog.tendigi.com/starbucks-should-really-make-their-... Skype is probably best in terms of securing the app from prying eyes and modification. Here's a good read on how they protected the app and the reverse engineering effort needed to crack it. http://www.oklabs.net/skype-reverse-engineering-genesis/ http://www.oklabs.net/skype-reverse-engineering-genesis/ I threw in my linkedin profile into my hackernews profile. Feel free to add me. I just listed stuff protecting the app, there's additional strategies to secure the API including low-level pack inspection to detect proxies by looking at attributes like TCP timestamp or window size scale. Proxy-based attacks are the most common when it comes to financial fraud as the hackers aren't US-based but need a residential US IP to avoid detection and IP ACLs.
    - baybal2 8y ago
      >The fact that your running on phone makes it harder for hackers since there is way more sensor data you have fake and you have to take the carrier stuff because carriers allow you poll devices for things like E911 location. You know, mobile ads companies resort to borderline exploits to fight botting, but even they loose out. Lockdown is a useless measure, from my experience. Both IOS and Android ad nets croak under 60-70% bot traffic.
- okmokmz 8y ago
  If preventing leaks was as simple as you say they wouldn't be occurring on a regular basis. Also, there are plenty of other ways that the data could be leaked that doesn't require compromising a proprietary app or the API.

The problem with this is that the more places that need a photocopy of your government id the more leaks are going to have photo ids in them. In the long run it won't work.

adrr 8y ago

It's an easy problem to solve. Force people to signup through app and make them take pictures of their documents. You can safeguard against all but state-sponsored attacks by simply obscuring your device oauth key and rotating it frequently through app updates, detecting emulation/simulator, pinging E911 location of the phone via the carrier. Look at how hard the Starbucks app is to crack open and get access to the remote APIs or how long Skype protected their protocol. Can easily put the same amount of effort to ensure that phone isn't tampered with and that you're getting a legitimate picture of the docs.

c4h8o3del 8y ago
> Force people to signup through app > Can easily put the same amount of effort to ensure that phone isn't tampered with You put a proprietary app on your phone. You presumably did this for other "secure" companies too. You no longer have a way to know who did or didn't tamper with it.
- adrr 8y ago
  Skype managed to do it for a communication app. Games do it all the time to prevents bots. How many AIMbots are there for on secured platform like PS4 or Xbox? There's none because its next to possible to do. The fact that your running on phone makes it harder for hackers since there is way more sensor data you have fake and you have to take the carrier stuff because carriers allow you poll devices for things like E911 location. You easily detect if you're running on a simulator and most modern financial apps have this protection. How are you going to hook up a debugger on IOS device? There isn't a jailbreak for the current OS. Setup cert pinning on the app and you won't be able to even install your own trusted cert to look at the TLS traffic.
  - dekimir 8y ago
    Is there a good writeup somewhere on how the phone apps you mentioned prevent tampering? I'd be super-interested in reading it. Alternatively, are you available for consulting on the topic? I couldn't find any contact info in your profile. :(
    - adrr 8y ago
      Caveat: I am not a security expert by any means. Starbucks app security is a good starter and easy to implement their strategies in an existing app. If you add in IOS version checking, you can help mitigate the risk of getting attacked by a jailbroken device on an older version of IOS. https://blog.tendigi.com/starbucks-should-really-make-their-apis-public-6b64a1c2e923 https://blog.tendigi.com/starbucks-should-really-make-their-... Skype is probably best in terms of securing the app from prying eyes and modification. Here's a good read on how they protected the app and the reverse engineering effort needed to crack it. http://www.oklabs.net/skype-reverse-engineering-genesis/ http://www.oklabs.net/skype-reverse-engineering-genesis/ I threw in my linkedin profile into my hackernews profile. Feel free to add me. I just listed stuff protecting the app, there's additional strategies to secure the API including low-level pack inspection to detect proxies by looking at attributes like TCP timestamp or window size scale. Proxy-based attacks are the most common when it comes to financial fraud as the hackers aren't US-based but need a residential US IP to avoid detection and IP ACLs.
  - baybal2 8y ago
    >The fact that your running on phone makes it harder for hackers since there is way more sensor data you have fake and you have to take the carrier stuff because carriers allow you poll devices for things like E911 location. You know, mobile ads companies resort to borderline exploits to fight botting, but even they loose out. Lockdown is a useless measure, from my experience. Both IOS and Android ad nets croak under 60-70% bot traffic.
okmokmz 8y ago
If preventing leaks was as simple as you say they wouldn't be occurring on a regular basis. Also, there are plenty of other ways that the data could be leaked that doesn't require compromising a proprietary app or the API.