3 ms·

Yeah, I mean, my major point is that Snapchat cannot deliver the services without trusting the client at some level, but that trust cannot be guaranteed.

by antics 13y ago

sbov 13y ago
I guess I don't understand the revelation here. Isn't this true of any client? Video game companies have been fighting this battle for over a decade. Maybe the problem is that I don't use snapchat so I don't understand why it's such a problem for them.
- jrockway 13y ago
  I think the problem is that Snapchat is significantly less complex than a video game. With a video game, a cheater might benefit from something like removing the fog of war. So the server can just calculate that itself, and not tell you about things your client can't see. This makes cheating more difficult. (But of course, the game needs to be fast, so sometimes you have to give the client more information than it should display. In this space, room for undetectable exploits exist, and so there is a lot of complexity like spyware that reads /proc/mem to check if you're cheating. Or so they say, I've never read the source code...) I've never used Snapchat, but from what I understand Snapchat basically sends people pictures with a time limit for looking at them. At that point, the client has perfect information, and it's up to the client to stop displaying the picture and remove it from system RAM, swap, CPU cache, GPU memory, and so on with 100% reliability after that timer expires, or the whole app is pointless. Since that's impossible unless you control every aspect of the system and encase it in self-destructing epoxy, the system is mostly pointless. (In that sense, it's like DRM. If you can view it, you can copy it.) My understanding is that this is mostly used for sexting, which begs for me to ask this question: why are you sending naked pictures of yourself to someone you don't trust with naked pictures of yourself? Maybe work on those human relationships rather than outsourcing trust to some random company? Get off my lawn. Wheeze.
  - aidanlister 13y ago
    Snapchat let's you sext people you trust right now, without having to worry about trusting them until the end of time.
  - schrodinger 13y ago
    It's not meant to be secure, it's meant to be delete by default. Even without an exploit you can take a screenshot of the picture you receive. However, defaults matter. Even if you're sending a private picture to someone you completely trust, if you do it by email or mms, they'll likely leave that picture lying around inadvertently for someone borrowing their phone to accidentally and embarrassingly stumble upon. With snapchat, the picture will be automatically deleted unless the recipient takes explicit measures to save it. THAT is the feature, not security.
  - girvo 13y ago
    It's not mostly used for sexting, though yes that is one use. It's mostly used for ephemeral, silly photos between friends.
  - DanBC 13y ago
    > or the whole app is pointless. It still has some use. I don't want to keep the photos of the lunch my sister just ate; she doesn't want to keep the image of the bread I just baked. SnapChat is handy for these kinds of things where people do not care at all about security. Obviously, if people are sending nudes and hoping those images will never find their way onto the Internet it's a bit more worrying. I guess we should be persuading people to think carefully before sending nude images of themselves to other people. (And educating youth about the perils of nudes).
- pencilo 13y ago
  There is an important difference between what Snapchat needs and what game designers need. First of all, look at what is actually successful for DRM in video games. The only surefire way to make sure someone is actually valid is to force them to authenticate(and get data from your server) to play the game. To do this they'll need to provide credentials(like a CD key) and then they'll get the content[1]. Now look at Snapchat. At no point do we need to fake having valid credentials. We are coming in and presenting valid credentials to Snapchat, my login and password, and it verifies those are correct and begins a sessions. If you want an analogy to game DRM you need to look toward things like hacked clients in MMOs. tl;dr Games want to prevent people without valid credentials from playing, we have valid credentials already(our own accounts). [1] This is really simplified and you can find many games, like the new SimCity, that the server interaction is small and simply emulated in the crack.

Yeah, I mean, my major point is that Snapchat cannot deliver the services without trusting the client at some level, but that trust cannot be guaranteed.

by antics 13y ago

Yeah, I mean, my major point is that Snapchat cannot deliver the services without trusting the client at some level, but that trust cannot be guaranteed.

sbov 13y ago

I guess I don't understand the revelation here. Isn't this true of any client? Video game companies have been fighting this battle for over a decade. Maybe the problem is that I don't use snapchat so I don't understand why it's such a problem for them.

jrockway 13y ago
I think the problem is that Snapchat is significantly less complex than a video game. With a video game, a cheater might benefit from something like removing the fog of war. So the server can just calculate that itself, and not tell you about things your client can't see. This makes cheating more difficult. (But of course, the game needs to be fast, so sometimes you have to give the client more information than it should display. In this space, room for undetectable exploits exist, and so there is a lot of complexity like spyware that reads /proc/mem to check if you're cheating. Or so they say, I've never read the source code...) I've never used Snapchat, but from what I understand Snapchat basically sends people pictures with a time limit for looking at them. At that point, the client has perfect information, and it's up to the client to stop displaying the picture and remove it from system RAM, swap, CPU cache, GPU memory, and so on with 100% reliability after that timer expires, or the whole app is pointless. Since that's impossible unless you control every aspect of the system and encase it in self-destructing epoxy, the system is mostly pointless. (In that sense, it's like DRM. If you can view it, you can copy it.) My understanding is that this is mostly used for sexting, which begs for me to ask this question: why are you sending naked pictures of yourself to someone you don't trust with naked pictures of yourself? Maybe work on those human relationships rather than outsourcing trust to some random company? Get off my lawn. Wheeze.
- aidanlister 13y ago
  Snapchat let's you sext people you trust right now, without having to worry about trusting them until the end of time.
- schrodinger 13y ago
  It's not meant to be secure, it's meant to be delete by default. Even without an exploit you can take a screenshot of the picture you receive. However, defaults matter. Even if you're sending a private picture to someone you completely trust, if you do it by email or mms, they'll likely leave that picture lying around inadvertently for someone borrowing their phone to accidentally and embarrassingly stumble upon. With snapchat, the picture will be automatically deleted unless the recipient takes explicit measures to save it. THAT is the feature, not security.
- girvo 13y ago
  It's not mostly used for sexting, though yes that is one use. It's mostly used for ephemeral, silly photos between friends.
- DanBC 13y ago
  > or the whole app is pointless. It still has some use. I don't want to keep the photos of the lunch my sister just ate; she doesn't want to keep the image of the bread I just baked. SnapChat is handy for these kinds of things where people do not care at all about security. Obviously, if people are sending nudes and hoping those images will never find their way onto the Internet it's a bit more worrying. I guess we should be persuading people to think carefully before sending nude images of themselves to other people. (And educating youth about the perils of nudes).
pencilo 13y ago
There is an important difference between what Snapchat needs and what game designers need. First of all, look at what is actually successful for DRM in video games. The only surefire way to make sure someone is actually valid is to force them to authenticate(and get data from your server) to play the game. To do this they'll need to provide credentials(like a CD key) and then they'll get the content[1]. Now look at Snapchat. At no point do we need to fake having valid credentials. We are coming in and presenting valid credentials to Snapchat, my login and password, and it verifies those are correct and begins a sessions. If you want an analogy to game DRM you need to look toward things like hacked clients in MMOs. tl;dr Games want to prevent people without valid credentials from playing, we have valid credentials already(our own accounts). [1] This is really simplified and you can find many games, like the new SimCity, that the server interaction is small and simply emulated in the crack.