5 ms·
Your scenario doesn't work at all given that such traffic is encrypted -- you can't simply inject into it. If someone breaks that, we have much bigger problems.
by corresation 13y ago
Your scenario doesn't work at all given that such traffic is encrypted -- you can't simply inject into it. If someone breaks that, we have much bigger problems.
However, to your ending comment, some time back I asked whether passwords actually gave you security from other people who know the same password (e.g. a coffee shop that has a big sign telling you the WPA password). While I have zero knowledge to confirm or deny this, someone in the know claimed that no, given that the wifi password is used for the initial key exchange, it offers superficial interception/monitoring protection against someone malicious who knows the same password. Take that with a grain of salt, but I never could find other resources on that.
- donutdan4114 13y agoTrue, 'tis only an example. Some rooted phonesmight be using 3rd party apps not on the Play Store that doesn't go through SSL. Not really sure how that works, I haven't rooted my phone. Also, I am assuming apps can make standard HTTP requests if they want to other external services, so an app that has access to your sensitive data might transmit it to home base non-securely. Hopefully this never actually happens, but given all the junior-made apps out there, some security holes like that probably exist.
- gohrt 13y agoWith a solution like TLS, your private keys and the server's private keys protect you. The password is your access to the network, not the encryption key for your messages.
- corresation 13y agoIndeed. That was the first paragraph of my comment. The second responded to the comment about never using open wifi networks, where I took open to mean unencrypted. My comment is that open and encrypted networks are synonymous (or so I have been told) if the person who wants to capture your traffic knows the network password. Which loops back to the first point, that you should only use encrypted services on networks you don't have full faith in.
- dsl 13y agoAre you sure downloads are encrypted? Sure store traffic is served over SSL, but large file downloads are often pushed off to non-SSL hosts. It is "safe" to not use transport security for the actual file download since the signatures are verified before install.
- kalleboo 13y agoI just checked - the Play store downloads aren't encrypted (client hits a HTTP URL that 301 redirects to another HTTP url) and all of these were fully visible in a HTTP proxy. There may be some additional hash-checking going on though, I can't say for sure (the actual listings of apps and their details are indeed encrypted). Hopefully they're not relying 100% on the APK signature check for downloads.
- ge0rg 13y agoThere is additional hash checking indeed. Google Play will fail to install an APK you MitM to the app. Edit: the hash checking is done in addition to the APK signature verification, i.e. you can not replace the APK with a different APK signed with the same developer key.