3 ms·

This is a very shallow (and questionable) intro to a paper about apps using things like string obfuscation to hide API keys and similar “secret” app data. I’m

by olliej 5y ago

This is a very shallow (and questionable) intro to a paper about apps using things like string obfuscation to hide API keys and similar “secret” app data. I’m not sure how we get from that to “threatening your privacy”. Unless you have personal data on the app’s server, and that data is unprotected by any access controls. Honestly this post seems clickbaity to me.

tyingq 5y ago
One example where there was a relationship: https://www.kshb.com/news/local-news/prosecutor-wont-charge-reporter-who-uncovered-database-flaw https://www.kshb.com/news/local-news/prosecutor-wont-charge-... The developers had put things like teacher's SSNs into base64 strings by using asp.net's viewstate functionality, making it all publicly accessible. I guess not the best example since it was probably accidental obfuscation via base64, with that obfuscation making the leak hard to spot for the probably inexperienced dev team.
salawat 5y ago
No it isn't. Look at most obfuscated JS, and if you sit down long enough and bother stepping through things, you'll find all sorts of cycles being wasted in order to make it hard to discern what type of information a script is exfiltrating. Iovation is one notorious example of such a script that ships that'll do all sorts of poking around to generate an obfuscated blackbox containing the config data that goes into their fingerprint. It's disgusting enough that I've begun blacklisting any software or services I come across that use it or similar tools.
- pabs3 5y ago
  How are you detecting users of lovation?
  - salawat 5y ago
    Usually end up digging through scripts looking for their payload or something similar. Defenitely not gotten to the point I'm actively working on a mechanism to fingerprint fingerprinters, but give it time. I'm on an embedded/graphics shtick at the moment, and once it gets feeling old enough, I may actually try doing a deep dive on neutering the thing. Unfortunately, it's held up by the fact I'm a stickler for consistency of action, and I've yet to come up with a rationalization that justifies fingerprinting fingerprinters without lending an extra chip of credence to their own misbehavior. Golden Rule implies treat others ss they treat others, but eh... That starts writing a blank check for people to ruin things for everyone else in a race to the bottom. However: A) Heavy use is made of shifting data into relatively unused parts of Unicode via bitshifts. You could make something that picks that up and uses that as a heuristic. B) Large base64 encoded chunks followed by XORs are also prevalent. C) The bloody thing touches every imaginable web browser API call. You'll probably filter out tons of other "defensively obfuscated javascript" by filtering on these behaviors, but over time, I've come to realize that if someone shows so little consideration for what they are doing to my power consumption by cramming down gobs of shite for my processor to slog through, I really can't build up the motivation to do business with them. I have a computer where bloated as hell websites run like they did in the 90's/00's all because somebody wants to slide something under the radar. No thanks.

by olliej 5y ago

tyingq 5y ago

One example where there was a relationship: https://www.kshb.com/news/local-news/prosecutor-wont-charge-reporter-who-uncovered-database-flaw https://www.kshb.com/news/local-news/prosecutor-wont-charge-... The developers had put things like teacher's SSNs into base64 strings by using asp.net's viewstate functionality, making it all publicly accessible. I guess not the best example since it was probably accidental obfuscation via base64, with that obfuscation making the leak hard to spot for the probably inexperienced dev team.

salawat 5y ago

No it isn't. Look at most obfuscated JS, and if you sit down long enough and bother stepping through things, you'll find all sorts of cycles being wasted in order to make it hard to discern what type of information a script is exfiltrating. Iovation is one notorious example of such a script that ships that'll do all sorts of poking around to generate an obfuscated blackbox containing the config data that goes into their fingerprint. It's disgusting enough that I've begun blacklisting any software or services I come across that use it or similar tools.

pabs3 5y ago
How are you detecting users of lovation?
- salawat 5y ago
  Usually end up digging through scripts looking for their payload or something similar. Defenitely not gotten to the point I'm actively working on a mechanism to fingerprint fingerprinters, but give it time. I'm on an embedded/graphics shtick at the moment, and once it gets feeling old enough, I may actually try doing a deep dive on neutering the thing. Unfortunately, it's held up by the fact I'm a stickler for consistency of action, and I've yet to come up with a rationalization that justifies fingerprinting fingerprinters without lending an extra chip of credence to their own misbehavior. Golden Rule implies treat others ss they treat others, but eh... That starts writing a blank check for people to ruin things for everyone else in a race to the bottom. However: A) Heavy use is made of shifting data into relatively unused parts of Unicode via bitshifts. You could make something that picks that up and uses that as a heuristic. B) Large base64 encoded chunks followed by XORs are also prevalent. C) The bloody thing touches every imaginable web browser API call. You'll probably filter out tons of other "defensively obfuscated javascript" by filtering on these behaviors, but over time, I've come to realize that if someone shows so little consideration for what they are doing to my power consumption by cramming down gobs of shite for my processor to slog through, I really can't build up the motivation to do business with them. I have a computer where bloated as hell websites run like they did in the 90's/00's all because somebody wants to slide something under the radar. No thanks.