6 ms·
IPhone Devs, don't put your private keys for push notification in your webroot
- ssclafani 16y agoHat tip to Billy Rios https://twitter.com/#!/XSSniper/status/46292790933590017 https://twitter.com/#!/XSSniper/status/46292790933590017
- oemera 16y agoWait. Does that mean I could send messages to all users using the app which is paired to this key? Hopefully no-one finds this out :/
- bkaid 16y agoNo - each user is assigned a token that you would also need to use in combination with the private key.
- jonhohle 16y agoYou could get all of the feedback pending for that key, as well, which would expose tokens, and potentially disrupt service.
- BenSS 16y agoIf you get the device tokens too, possibly. Unfortunately it looks like some of these are ALSO exposed. Argh. http://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/ApplePushService/ApplePushService.html#//apple_ref/doc/uid/TP40008194-CH100-SW3 http://developer.apple.com/library/ios/documentation/Network...
- BenSS 16y agoI'm glad that doing it this way has never, ever occurred to me. Would you publish your private ssh key?
- uxp 16y agoThat is a good question: https://encrypted.google.com/search?sourceid=chrome&ie=UTF-8&q=%22BEGIN+RSA+PRIVATE+KEY%22+inurl%3Aid_rsa https://encrypted.google.com/search?sourceid=chrome&ie=U...
- btipling 16y agoI just made encrypted.google.com my default search.
- deleted 16y ago[deleted]
- Johngibb 16y agoUnfortunate bug: if you hit encrypted.google.com on an iPhone, you're redirected to the unencrypted mobile version of the site... Not good!
- uxp 16y agohttps://www.google.com/m https://www.google.com/m works, it looks like.
- JonnieCache 16y agoFun fact: SSL sites don't send referer headers, so sites can't sniff your search keywords.
- jonny_eh 16y agoWhat does having these keys allow?
- mman 16y agoA UIApplication method (registerForRemoteNotificationTypes:) negotiates with apples servers using device information to obtain a 32-byte push token unique to a given device/app pair. It is likely based on the device's global id (UDID) and the application's appid and certificates. Someone should figure out the exact network handshake. Any app developer is capable of collecting UDIDs using their released apps (the UDID is constant and visible across all apps). Note, having the UDID does not necessarily mean you can obtain the push token. But you may be able to derive the push token from it and from information contained in the app. Assuming you could figure out someone's push token, you could to cause a push to show up in the name of the app whose certificate/key you've obtained!
- oasisbob 16y ago> 32-byte push token unique to a given device/app pair. It is likely based on the device's global id (UDID) and the application's appid and certificates. This isn't quite correct, the device token is not unique per app, it's unique per device. (Technically, a device will have two tokens, one for the APNS sandbox, and the second for production.) The device token can't be derived by mere mortals, it is a cryptographic identifier returned from APNS to the device.
- BenSS 16y agoUnfortunately, by a bit of digging I was able to reveal some actual push tokens. I could now send messages to an app that is not mine!
- cnkt 16y agoPrivate keys in public domains, priceless.
- fuzzmeister 16y agoFun fact: every single URL on the first page of results also has Apache directory listing enabled.
- A1kmm 16y agoI expect that is why they are indexed - they aren't exactly going to link to their private key from another page.
- fuzzmeister 16y agoAh, good point.