4 ms·

Hm, I have a Pixel 5 and it most certainly doesn't do that. Nothing happens. https://i.imgur.com/kjFEwiR.jpg https://i.imgur.com/kjFEwiR.jpg Then again, start

by dheera 5y ago

Hm, I have a Pixel 5 and it most certainly doesn't do that. Nothing happens. https://i.imgur.com/kjFEwiR.jpg https://i.imgur.com/kjFEwiR.jpg Then again, starting about 5 weeks ago it also stopped responding to "OK Google" and 3 weeks ago it stopped announcing turn-by-turn directions during GPS navigation so I guess this is the state of tech in 2021 :-/ (Definitely don't want an Apple device though, massive privacy issue for me to use a closed source kernel and that I can't easily introspect and MITM SSL requests on to see what data is being sent about me, I do like Android for the fact that I can more or less much hook into any part of the OS and execute custom code to monitor what the hell apps are doing behind the curtain, and even give them fake-but-realistic sensor data to even further protect my privacy.)

dzhiurgis 5y ago
How do you do MITM SSL when pretty much every secure app use key pinning.
- dheera 5y ago
  Exactly, on iOS it's not easy, on Android it's far easier because the OS listens to you, not Apple or Google, and it's far easier to root Android than it is to jailbreak iOS, or run an open source fork like LineageOS and run the same apps on that. You can (a) decompile the app, mod it, recompile it, sign it, and then execute it (b) modify the OS to not care about app signatures (c) bypass it with Xposed hooks, ... lots of ways.
  - dzhiurgis 5y ago
    I find hard to believe that you can decompile any app that has bothered implementing key pinning (which I always assumed is done at app level, not OS).
    - mcny 5y ago
      Speaking of https, I will give my own example. I can get to the cockpit (local ip:9090) of my fedora machine on my android phone if I continue past the scary warning but not on my iphone.
      - lorenzhs 5y ago
        You can most definitely bypass the invalid certificate warning on iOS (I also have a device that uses a self-signed certificate and listens on a local IP, I can open its web interface just fine on iOS)
      - NavinF 5y ago
        I can bypass the self-signed cert error on my iPhone 8 on iOS 14.4.2 That aside, what's the point? There's no practical threat model where https makes what you're doing more secure. If you have neither a domain name that can use a real TLS cert nor your own CA added to the mobile device, it would be trivial for someone to MITM you. Just configure your Fedora dashboard to use http if you don't care about security
fingerlocks 5y ago
I think you have this backwards? Its much easier to bypass cert pinning and MITM a local process on an Apple device. Disable SIP on Mac OS or jailbreak an iPhone (15 minutes on almost the latest iOS), ‘lldb attach’ and away you swizzle.
bitten 5y ago
Pixel user here too. You have to enable "Google Lens suggestions" in the camera settings for it to read QR codes automatically. Drop down menu > Camera Settings > Google Lens suggestions.
- SethMurphy 5y ago
  In addition on my pixel 3 you can open camera app and long press QR code. This works with or without enabling lens suggestions. So, double press power button, long tap QR code, and click link to visit site.
atatatat 5y ago
I stopped trusting Google to put out bugfree products right around the time the Chromecast 2 came out. It's been a downhill expectation on experience since.

by dheera 5y ago

dzhiurgis 5y ago

How do you do MITM SSL when pretty much every secure app use key pinning.

dheera 5y ago
Exactly, on iOS it's not easy, on Android it's far easier because the OS listens to you, not Apple or Google, and it's far easier to root Android than it is to jailbreak iOS, or run an open source fork like LineageOS and run the same apps on that. You can (a) decompile the app, mod it, recompile it, sign it, and then execute it (b) modify the OS to not care about app signatures (c) bypass it with Xposed hooks, ... lots of ways.
- dzhiurgis 5y ago
  I find hard to believe that you can decompile any app that has bothered implementing key pinning (which I always assumed is done at app level, not OS).
  - mcny 5y ago
    Speaking of https, I will give my own example. I can get to the cockpit (local ip:9090) of my fedora machine on my android phone if I continue past the scary warning but not on my iphone.
    - lorenzhs 5y ago
      You can most definitely bypass the invalid certificate warning on iOS (I also have a device that uses a self-signed certificate and listens on a local IP, I can open its web interface just fine on iOS)
    - NavinF 5y ago
      I can bypass the self-signed cert error on my iPhone 8 on iOS 14.4.2 That aside, what's the point? There's no practical threat model where https makes what you're doing more secure. If you have neither a domain name that can use a real TLS cert nor your own CA added to the mobile device, it would be trivial for someone to MITM you. Just configure your Fedora dashboard to use http if you don't care about security

fingerlocks 5y ago

I think you have this backwards? Its much easier to bypass cert pinning and MITM a local process on an Apple device. Disable SIP on Mac OS or jailbreak an iPhone (15 minutes on almost the latest iOS), ‘lldb attach’ and away you swizzle.

bitten 5y ago

Pixel user here too. You have to enable "Google Lens suggestions" in the camera settings for it to read QR codes automatically. Drop down menu > Camera Settings > Google Lens suggestions.

SethMurphy 5y ago
In addition on my pixel 3 you can open camera app and long press QR code. This works with or without enabling lens suggestions. So, double press power button, long tap QR code, and click link to visit site.

atatatat 5y ago

I stopped trusting Google to put out bugfree products right around the time the Chromecast 2 came out. It's been a downhill expectation on experience since.