3 ms·
> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you m
by elwell 12y ago
> Intercept and decrypt all snapchats received over your network
Somewhat misleading in light of:
> Anyway, for Snapception to intercept your snapchats, you must be connected to the computer via a proxy and have installed its CA
Interesting, nevertheless, because it exposes that:
> they use one, hardcoded key for all video and image encryption
- ChuckMcM 12y agoTheir point was, I believe, that you could store copies of all snaps sent to you without anything on your device which snapchat could "check" to see if it was being interfered with.
- asdfaoeu 12y agoSo? Everyone should know that. Just get a camera?
- Pengwin 12y agoThis has been reality for more than a year. In fact, i've been running a bot based off https://github.com/JorgenPhi/php-snapchat https://github.com/JorgenPhi/php-snapchat for the past 11 months. it has over 5000 friends, and its popularity puts me to shame :(
- Perseids 12y agoThey could use certificate pinning [1] (and really, there is no reason for an app author not do so, except for the additional work) which would thwart all man-in-the-middle attacks. The end-point is still open through the analog gap (photograph of the screen) and custom clients, though. [1] https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning#Android https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
- deleted 12y ago[deleted]