3 ms·
As a small-time reverser I can tell you, even without having heard of this program before now, that it is insecure. The rule of thumb: If it runs on the client
by SCHiM 11y ago
As a small-time reverser I can tell you, even without having heard of this program before now, that it is insecure.
The rule of thumb: If it runs on the client's device or if the client can read it then it can be cracked, inspected, seen, analyzed and decoded. There is nothing you can do to protect code/data you send to the client's device (for long).
- StavrosK 11y agoThe client isn't the problem, since you could push custom code to read the wifi key yourself. The problem is that the server will have everyone's Wifi keys.
- ProblemFactory 11y agoThe problem isn't in reading, but using the wifi key. The app promises to keep the wifi keys secret from other users: > "... credentials are added to the database so that everyone else on the app can also use that hotspot. Users cannot actually view these credentials so as to protect user data." But if a client app can download the wifi key from the server and use it to log in, then a modified client app could also download all wifi keys and show them to the user. There is no practical way for the server to distinguish the original client app from a modified one as long as the user is in control of the hardware and OS it runs on.
- StavrosK 11y agoOh, I see what you mean now, I thought they meant secret on the server. Yeah, obviously they can be read if they go to the device, and verroq on the other thread looks like he found out how to decrypt the keys in the local cache.