3 ms·

what worries me, and is related to the issues described in that article, is that the various examples i've seen don't seem to be secure. the path loading was v

what worries me, and is related to the issues described in that article, is that the various examples i've seen don't seem to be secure. the path loading was via https/tls but seemed to be (from the description given at the time) vulnerable to a simple mitm attack. that means that the server certificate was not being validated correctly. another example (can't remember the company) was using http. in both cases, a clued-up governmental agency could read the data. as the article says, this can be a big fucking deal. tldr: if you're going to abuse people's privacy, at least do it right. [it's possible that the tls case involved loading a new trusted certificate onto the phone before the attack; i did check for that when i read the description and couldn't find any mention, but if that's the case then the loading would be secure - although even then, it might have been possible for path to hard code details of which ca they trust.]

relme 15y ago
In order to mitm over https you have to install a special certificate, for example, http://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/ http://www.charlesproxy.com/documentation/faqs/ssl-connectio...
- andrewcooke 15y ago
  that is not included in the step-by-step instructions at the end of http://mclov.in/2012/02/08/path-uploads-your-entire-address-book-to-their-servers.html http://mclov.in/2012/02/08/path-uploads-your-entire-address-... i agree that, if it was done, then the transfer is more secure, but, as i said, that does not appear to be the case.
lambda 15y ago
Note TrustWave, a widely trusted certificate authority, has recently explicitly acknowledged selling devices with subordinate root certificates that allow them to spoof certs for any domain that they want in order to allow companies to snoop on their employees. http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-ca-policy-update.html http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-... If they are willing to sell these to private organizations, who's to say that one of the many certificate authorities have not sold such devices or certificates to repressive governments? SSL is basically a joke at this point. Because it requires you to trust every single certificate authority for every single domain, it basically means that you are only protected against the average script kiddie, not a dedicated attacker. There have been plenty of CAs compromised, who continued to issue MD5 signed certificates well after it was broken, who are within the control of authoritarian governments, or who are willing to sell subordinate root certs for the purpose of snooping to any company who is willing to pay enough. And that's not to mention that even if the information is properly protected in transit, putting this information on your servers makes you that much more vulnerable to attackers who may want access to this information, the government of the country in which it is hosted, legal process, or any number of other threats. Even if they had properly secured the information in transit, and SSL were secure, it still vastly increases your customers exposure to upload this information to your servers.
guest 15y ago
clued up government agencies don't need to jump through such hoops. they get to warrantlessly wiretap everyone and then get a pass.

relme 15y ago

In order to mitm over https you have to install a special certificate, for example, http://www.charlesproxy.com/documentation/faqs/ssl-connections-from-within-iphone-applications/ http://www.charlesproxy.com/documentation/faqs/ssl-connectio...

andrewcooke 15y ago
that is not included in the step-by-step instructions at the end of http://mclov.in/2012/02/08/path-uploads-your-entire-address-book-to-their-servers.html http://mclov.in/2012/02/08/path-uploads-your-entire-address-... i agree that, if it was done, then the transfer is more secure, but, as i said, that does not appear to be the case.

lambda 15y ago

Note TrustWave, a widely trusted certificate authority, has recently explicitly acknowledged selling devices with subordinate root certificates that allow them to spoof certs for any domain that they want in order to allow companies to snoop on their employees. http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-ca-policy-update.html http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-... If they are willing to sell these to private organizations, who's to say that one of the many certificate authorities have not sold such devices or certificates to repressive governments? SSL is basically a joke at this point. Because it requires you to trust every single certificate authority for every single domain, it basically means that you are only protected against the average script kiddie, not a dedicated attacker. There have been plenty of CAs compromised, who continued to issue MD5 signed certificates well after it was broken, who are within the control of authoritarian governments, or who are willing to sell subordinate root certs for the purpose of snooping to any company who is willing to pay enough. And that's not to mention that even if the information is properly protected in transit, putting this information on your servers makes you that much more vulnerable to attackers who may want access to this information, the government of the country in which it is hosted, legal process, or any number of other threats. Even if they had properly secured the information in transit, and SSL were secure, it still vastly increases your customers exposure to upload this information to your servers.

guest 15y ago

clued up government agencies don't need to jump through such hoops. they get to warrantlessly wiretap everyone and then get a pass.