5 ms·

The problem is the attack surface for an app on a device vs. in the wild is much, much larger and much, much less secure. Once its on your phone, it can just s

The problem is the attack surface for an app on a device vs. in the wild is much, much larger and much, much less secure. Once its on your phone, it can just screenshot things if nothing else.

Spearchucker 12y ago
I wrote myself a database that I use for passwords and the like. I get around this by masking text until I tap a button, and then waiting a random number of ticks before decrypting the value and progressively unmasking the text. It takes between ½ and two seconds. The problem I've yet to solve is hiding the text. Leaving it on-screen for, say 10 seconds before re-masking and encrypting is fine for now but sometimes that's not long enough. The other thing it does is with a tap and waiting for the same random number of ticks is to copy the value to the clipboard so that I can paste it into a browser. Not perfect but its a version 1 at least.
- exhilaration 12y ago
  You should try 1Password: https://agilebits.com/onepassword https://agilebits.com/onepassword It's the most recommended password manager on Hacker News.
  - Spearchucker 12y ago
    Thanks, I'm aware of it but it doesn't work for me. Beyond what I described above, I need something that works on Windows and Windows Phone, and I need it to securely sync between the two.
    - ghshephard 12y ago
      This implies that there is a version of 1Password for windows phone? https://discussions.agilebits.com/discussion/12133/1password-for-windows-phone-8 https://discussions.agilebits.com/discussion/12133/1password...
      - exhilaration 12y ago
        Indeed there is: http://www.windowsphone.com/en-us/store/app/1password/21ed2e70-e011-e011-9264-00237de2db9e http://www.windowsphone.com/en-us/store/app/1password/21ed2e...
    - diafygi 12y ago
      Can you use KeePass and just sync the database via dropbox?
icebraining 12y ago
Once its on your phone, it can just screenshot things if nothing else. If it can't run, how can it screenshot things?
scintill76 12y ago
Android requires root privilege and/or system-level app to take screenshots. iOS is probably similar. I don't think an app could spy like this without user enabling it (which is a valid but separate concern about how knowledgeable the average rooter/jailbreaker is.) [0] http://android.stackexchange.com/questions/10930/why-do-we-need-a-rooted-phone-to-capture-screenshots http://android.stackexchange.com/questions/10930/why-do-we-n...
- TeMPOraL 12y ago
  From http://stackoverflow.com/questions/12462944/how-to-take-a-screenshot-of-other-app-programmatically-without-root-permission http://stackoverflow.com/questions/12462944/how-to-take-a-sc...: ====== Using hardware partners Now we get into the solutions which require commercial action. Talking to the Android chipset makers often presents a solution. Since they design the hardware, they have access to the framebuffer - and they often are able to provide libraries which entirely avoid the Android permissions model by simply accessing their custom kernel drivers directly. If you're aiming at a specific phone model, this is often a good way forward. Of course, the odds are you'll need to cooperate with the phone maker as well as the silicon manufacturer. Sometimes this can provide outstanding results. For example I have heard it's possible on some hardware to pipe the phone hardware framebuffer directly into the phone hardware H.264 video encoder, and retrieve a pre-encoded video stream of whatever is on the phone screen. Outstanding. (Unfortunately, I only know this is possible on TI OMAP chips, which are gradually withdrawing from the phone market3). ====== Probably not something an average crapware author can do, but certainly within reach of the NSA.
- c_c_c 12y ago
  Maybe I'm not fully understanding here but the last two phones I've used do not require root or any app to take screenshots. Nexus 5 and Moto X.
  - scintill76 12y ago
    By root, I meant that an app with root access could probably take screenshots, not that a root app is needed for the user to access the system's screenshot capability.

The problem is the attack surface for an app on a device vs. in the wild is much, much larger and much, much less secure. Once its on your phone, it can just screenshot things if nothing else.

Spearchucker 12y ago

I wrote myself a database that I use for passwords and the like. I get around this by masking text until I tap a button, and then waiting a random number of ticks before decrypting the value and progressively unmasking the text. It takes between ½ and two seconds. The problem I've yet to solve is hiding the text. Leaving it on-screen for, say 10 seconds before re-masking and encrypting is fine for now but sometimes that's not long enough. The other thing it does is with a tap and waiting for the same random number of ticks is to copy the value to the clipboard so that I can paste it into a browser. Not perfect but its a version 1 at least.

exhilaration 12y ago
You should try 1Password: https://agilebits.com/onepassword https://agilebits.com/onepassword It's the most recommended password manager on Hacker News.
- Spearchucker 12y ago
  Thanks, I'm aware of it but it doesn't work for me. Beyond what I described above, I need something that works on Windows and Windows Phone, and I need it to securely sync between the two.
  - ghshephard 12y ago
    This implies that there is a version of 1Password for windows phone? https://discussions.agilebits.com/discussion/12133/1password-for-windows-phone-8 https://discussions.agilebits.com/discussion/12133/1password...
    - exhilaration 12y ago
      Indeed there is: http://www.windowsphone.com/en-us/store/app/1password/21ed2e70-e011-e011-9264-00237de2db9e http://www.windowsphone.com/en-us/store/app/1password/21ed2e...
  - diafygi 12y ago
    Can you use KeePass and just sync the database via dropbox?

icebraining 12y ago

Once its on your phone, it can just screenshot things if nothing else. If it can't run, how can it screenshot things?

scintill76 12y ago

Android requires root privilege and/or system-level app to take screenshots. iOS is probably similar. I don't think an app could spy like this without user enabling it (which is a valid but separate concern about how knowledgeable the average rooter/jailbreaker is.) [0] http://android.stackexchange.com/questions/10930/why-do-we-need-a-rooted-phone-to-capture-screenshots http://android.stackexchange.com/questions/10930/why-do-we-n...

TeMPOraL 12y ago
From http://stackoverflow.com/questions/12462944/how-to-take-a-screenshot-of-other-app-programmatically-without-root-permission http://stackoverflow.com/questions/12462944/how-to-take-a-sc...: ====== Using hardware partners Now we get into the solutions which require commercial action. Talking to the Android chipset makers often presents a solution. Since they design the hardware, they have access to the framebuffer - and they often are able to provide libraries which entirely avoid the Android permissions model by simply accessing their custom kernel drivers directly. If you're aiming at a specific phone model, this is often a good way forward. Of course, the odds are you'll need to cooperate with the phone maker as well as the silicon manufacturer. Sometimes this can provide outstanding results. For example I have heard it's possible on some hardware to pipe the phone hardware framebuffer directly into the phone hardware H.264 video encoder, and retrieve a pre-encoded video stream of whatever is on the phone screen. Outstanding. (Unfortunately, I only know this is possible on TI OMAP chips, which are gradually withdrawing from the phone market3). ====== Probably not something an average crapware author can do, but certainly within reach of the NSA.
c_c_c 12y ago
Maybe I'm not fully understanding here but the last two phones I've used do not require root or any app to take screenshots. Nexus 5 and Moto X.
- scintill76 12y ago
  By root, I meant that an app with root access could probably take screenshots, not that a root app is needed for the user to access the system's screenshot capability.