6 ms·
This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???
by pta2002 2y ago
This is like the fifth article I've read about the McDonald's app not having any sort of server-side validation. How do they keep getting this wrong???
- lazide 2y agoIs there anything you know about McDonalds as an entity that would lead you to believe they know about, or would prioritize, building a secure app? Honestly, it’s amazing it’s not worse!
- RicoElectrico 2y agoThe said root checks for example?
- notpushkin 2y agoWhich indicate that the management wants to feel good, not that the app developers care about actual security.
- PittleyDunkin 2y agoThey have money and want to make more money? This seems like a straightforward question to answer.
- TeMPOraL 2y agoYes, except the answer is opposite to what you think. Shitty and insecure apps make more money than decent and secure ones.
- graemep 2y agoThis sort of things happens a lot. A few years ago a British bus company put certificates in the app to sign tickets. The HSBC UK app will not run if you have any apps installed from outside play store. I cannot log into the website without the app. Luckily all I have with them is a lightly used credit card with a low limit so I have just stopped using it and rely on paper statement. I find it disturbing that any app can examine your device in this much detail.
- ajb 2y agoYou could try getting them to give you a physical security key, they used to supply them and I think still will if you can't use the app (just say it doesn't work on your phone). I have one and the website still works with it.
- graemep 2y agoThanks, I was thinking of phoning and asking, but good to know there is some point in waiting in the queue to talk to someone!
- ajb 2y agoIf you're near a branch you can also just pop in and ask for one; might be faster. I did that when the battery ran out on my last one. There's no process upfront, you then have to pair it with your account. Well,you will probably have to convince them to switch your account to use a physical key - maybe that means you have to call anyway, I don't know.
- robertlagrant 2y ago> I find it disturbing that any app can examine your device in this much detail. When I did a tiny bit of Android development a few years ago, I was astonished how free the app I made was to just examine the file system. I assumed it would be like the web, where each website can have its own little SQLite database and cookie store equivalent, but that's it. I don't know if it's changed, or if it was just because I was in a "dev mode" somehow, but that was very surprising.
- HeatrayEnjoyer 2y agoBy default you can `ls` almost anything on an entire drive.
- liontwist 2y agoThat is how it works. Apps on android and iOS can’t access data outside of their contsiner.
- TeMPOraL 2y agoMore importantly, why would anyone care? Is this some 5th dimensional chess marketing strategy by McDonald's? I hear more about their app these days than ever, and more than about any other security issue anywhere else.
- Zak 2y agoI think it's the combination of trying very hard to usurp the user's control over their device, the lack of obvious reasons to do so, and the size of the brand. It doesn't surprise anybody when a bank does this, and nobody cares when some crappy pay to win game does, but McDonalds?! I haven't eaten food from McDonalds in years and have never even considered installing their app, but if inspecting and reverse-engineering Android apps was my thing, theirs would have almost certainly caught my interest.
- izacus 2y agoWell, they're also an app that relies (at least on Android) on Google's Play Integrity DRM to "keep it safe" from those pesky root users. And like clockwork, this false sense of security leads developers into stupidly trusting the client.
- red_trumpet 2y agoI don't know much about this. Is this a (possible fundamental) flaw in Google's Play Integrity DRM, or did the developers implement it wrongly?
- codetrotter 2y agoIt makes sense, to some degree, that for example some banking apps refuse to run if they detect that the phone has been rooted, or even to go as far as to refuse to run if there are non-Play apps on the phone. Maybe some apps with DRM media playback do this kind of check too, yes. Haven’t used Android for many years now. Hopefully iOS stays the way it is where apps don’t get so much info about other apps on device. I prefer it that way.
- izacus 2y agoWhat's implemented wrongly is the idea that this kind of client side check somehow removes the need for server side verification. And the idea that this kind of check can't be defeated.
- kuschku 2y agoDRM doesn't protect, it only delays. Never trust the client. Anything the client has access to, whether "protected" by Play Integrity or not, should be considered compromised.
- hansvm 2y agoGPIDRM doesn't protect against much, even if it's perfect [0]. What it gives you is an API your Android app can call into to inspect the device status. That's not enough because the owner of the phone can just twiddle that memory between you calling the API and using the value. You fully own the code that runs on your devices, and if you don't like it then you can just choose to run different code. The GPIDRM hinders some users who want to fully own their device and also use your app, but it doesn't actually protect your app from being executed in other environments (similarly with any other modification to how the GPIDRM might function, short of it physically decrypting the code/data you intend to run and only ever running in environments that would somehow prevent people from backing up those decrypted bytes -- or, similarly, physically decrypting data unique to a particular instance of using the app and not useful for any reason when somebody else runs the app). When, then, does GPIDRM make sense to use? _Arguably_ the thing that banks do isn't terrible [1]. Their servers are authenticated, so it's not a security thing. They're just managing risk (people with rooted phones might be more likely to have root-level malware for example). If somebody has a rootkit leaking banking details and the attacker is also willing to pay $10 to borrow their phone number for the day, the bank account will be fully compromised. When that happens, the bank is on the hook some fraction of the time. The bank server trusts requests to either come from a real user or a user with stolen credentials, and they're trying to reduce the chance of the latter (but not eliminate, even from rooted Android phones). How does McDonald's differ? There are no server-side checks, no passwords, no logins, no crypto handshakes, no anything. If you send a request pinky promising you're a trusted client then you'll get your free food. The implementation was so bad that the TFA demonstrated compromising it on a phone which _correctly_ passed the GPIDRM check. [0] No such technique can be perfect. At its core, it relies on a secure hardware enclave. Physical keys are always reversible with enough time and effort, in time _linear_ in the key length. The goal is just to create a constant factor big enough that almost nobody with expensive enough tools to dismantle the chip and go probing is willing to go through the effort (or, ideally, not able to with the current generation of technology, so that rotating keys every few years can keep up with reversing efforts). [1] I'd be shocked if people with rooted Android phones were actually more likely to be victims of phishing/malware/....
- nslqnd 2y agoAs a contractor who works building apps (and their server backends) for big clients: I don’t give a fuck. I just do the minimum so the app works. The worst that can happen is that the client asks me to fix the flaw later on, for which I will bill more hours. I can 100% guarantee that’s what happened here.
- williebeek 2y agoI assumed there is always some technical documentation/app architecture and some mandatory (server side) security you have to follow, but reading this I'm being too optimistic.
- deleted 2y ago[deleted]
- jddj 2y ago> the worst that can happen To you, you mean, right?
- chefandy 2y agoThat goes without saying in the software business today. I was in software for decades and I’ve never seen it so cynical. Shameless profiteering seems to be the gold standard strategy. It’s like Gordon Gecko style greed.
- gunian 2y agoThat's cause there are people that make the mean girls from mean girls look like the nice girls Infighting, KPIs, comp packages, weird ass games trying to build something new or try to learn is actually looked down upon. Very medieval with hunt vibes
- AlexandrB 2y agoIt's hardly surprising. Once they smelled cash in the water all the Gordon Geckos packed up their finance bags and moved into tech.
- 2y ago
- some_random 2y agoMcDonalds has historically not put an emphasis on security, imo it's just that simple.