5 ms·

Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, r

Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a scary-looking tool for intercepting the general stream of snaps (as it is made out to be).

chrissnell 12y ago
Not necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our employees browsers through an ad-blocking proxy. Depending on your user base (kids?), it could be as simple as setting up an open wifi access point in a place where all other APs are password-locked. Edit: I just realized that this proxy requires the device users to load a CA cert. That makes things a little more difficult but still not impossible. Through creative social/software engineering, you might be able to persuade the users of your rogue access point to load the CA cert "in order to use this free service".
- brazzledazzle 12y ago
  Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
  - downandout 12y ago
    That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
    - chrissnell 12y ago
      Good point, but it's an interesting idea. An open-source home firewall that's designed with features/sniffers that lets parents keep an eye on their kids' online usage.
      - downandout 12y ago
        I was thinking the same thing. Call it Kidsafe or something. Make it automatically configure the router and let parents access the info online. Most phones are programmed to use wifi at home - seems like a promising opportunity.
    - Cthulhu_ 12y ago
      "Oh my GAWD MOM! YOU ALWAYS DO THIS! squeals hysterically"
  - maccard 12y ago
    Have you met a teenager? They will blindly just click ignore/ok until they can do what they want. an invalid cert error isn't going to stop them unless it actually blocks (rather than warns and lets them proceed)
    - ColinDabritz 12y ago
      In fact, most users will behave this way, it's not exclusive to teenagers.
    - iancarroll 12y ago
      Pretty sure you can't hit OK on this one, it'll just hard fail.
- cpach 12y ago
  If Mallory can install an arbitrary root certificate on Alice’s client, M can do nearly whatever she wants with A’s client.
- userbinator 12y ago
  I've been using the same setup locally for years - ad-blocking/page-rewriting proxy to MITM the browsers on my machine and filter parts of pages that I don't want to even reach the browser. If Snapchat required each user have a separate public/private keypair (which would be transferred through other means, maybe even in-person), like what SSH uses, then they would be less amenable to being MITM'd via a single centralised trusted authority.
plorg 12y ago
Or, perhaps, as a tool for an individual user who, for miscellaneous reasons, wants to store his or her received snaps for use later. Again, the point, as given by the author and expanded by me, is that the Snapchat system contains a large security vulnerability, and that it is foolhardy to believe that snaps you send will be gone as soon as the recipient sees them.
teacup50 12y ago
Remember the iOS SSL bug from just this year that resulted in a complete bypass of x509 certificate trust validation?

chrissnell 12y ago

Not necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our employees browsers through an ad-blocking proxy. Depending on your user base (kids?), it could be as simple as setting up an open wifi access point in a place where all other APs are password-locked. Edit: I just realized that this proxy requires the device users to load a CA cert. That makes things a little more difficult but still not impossible. Through creative social/software engineering, you might be able to persuade the users of your rogue access point to load the CA cert "in order to use this free service".

brazzledazzle 12y ago
Yes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
- downandout 12y ago
  That's pretty trivial for parents. "Hey pumpkin, I need to borrow your phone for a second". That said this is something that maybe 0.1% of parents could or would set up.
  - chrissnell 12y ago
    Good point, but it's an interesting idea. An open-source home firewall that's designed with features/sniffers that lets parents keep an eye on their kids' online usage.
    - downandout 12y ago
      I was thinking the same thing. Call it Kidsafe or something. Make it automatically configure the router and let parents access the info online. Most phones are programmed to use wifi at home - seems like a promising opportunity.
  - Cthulhu_ 12y ago
    "Oh my GAWD MOM! YOU ALWAYS DO THIS! squeals hysterically"
- maccard 12y ago
  Have you met a teenager? They will blindly just click ignore/ok until they can do what they want. an invalid cert error isn't going to stop them unless it actually blocks (rather than warns and lets them proceed)
  - ColinDabritz 12y ago
    In fact, most users will behave this way, it's not exclusive to teenagers.
  - iancarroll 12y ago
    Pretty sure you can't hit OK on this one, it'll just hard fail.
cpach 12y ago
If Mallory can install an arbitrary root certificate on Alice’s client, M can do nearly whatever she wants with A’s client.
userbinator 12y ago
I've been using the same setup locally for years - ad-blocking/page-rewriting proxy to MITM the browsers on my machine and filter parts of pages that I don't want to even reach the browser. If Snapchat required each user have a separate public/private keypair (which would be transferred through other means, maybe even in-person), like what SSH uses, then they would be less amenable to being MITM'd via a single centralised trusted authority.

plorg 12y ago

Or, perhaps, as a tool for an individual user who, for miscellaneous reasons, wants to store his or her received snaps for use later. Again, the point, as given by the author and expanded by me, is that the Snapchat system contains a large security vulnerability, and that it is foolhardy to believe that snaps you send will be gone as soon as the recipient sees them.

teacup50 12y ago

Remember the iOS SSL bug from just this year that resulted in a complete bypass of x509 certificate trust validation?