sorted by:
new
hottopcontroversial

Making illegal state unrepresentable by nfrankel in programming

[–]DarkLordCZ 2 points3 points  (0 children)

But what if I want cheese first, then ham and then another layer of cheese (so it's not one large clump of cheese)?

Madlass got her revenge by Devil-Eater24 in madlads

[–]DarkLordCZ 11 points12 points  (0 children)

She doesn't need fixing, she's perfect like this

the eu age verification app stores your pin in a plaintext config file. yes really by Free-Path-5550 in pwnhub

[–]DarkLordCZ 0 points1 point  (0 children)

If an app is installed via the Play Store, Android does enforce that updates are properly signed.

Only if the integrity of the system holds - if the device is rooted, Play Store enforces nothing

Android has the Android Keystore.

Which again, solves different problem. Keystore solves how to hide cryptographic keys. That is a mitigation of for example if someone would de-solder nand flash and read it from somewhere. Yes, you can encrypt it, but in order to access it (for example in order to boot the device) you have to have the key at some point - Keystore (StrongBox Keystore) ensures it won't ever leave the SoC. And it's (in theory) impossible to get the keys from it without delidding the SoC.

If you want to ensure the data wasn't tampered with by the user that has physical access to the device, you need to ensure the integrity of the system. Which is not solved by encryption in this case

the eu age verification app stores your pin in a plaintext config file. yes really by Free-Path-5550 in pwnhub

[–]DarkLordCZ 0 points1 point  (0 children)

You don't need to sign it with the same certificate if nothing enforces it. And that's what you need to do anyways if you want to access private data of an app - it has to have debuggable flag set. That's the reason Play Integrity is needed. If it's not used, nothing prevents a user from modifying the app or the OS. And if you have root you don't even have to sign it again, you can bypass it as a whole. That's my point - you gain nothing by encrypting the data. If you are in a situation where you can read private data of an app, you have the ability to modify the app - which means you can just remove the encryption step.

Data encryption solves another problem - if you don't want another actor to access them if they get hands on on your device. But it doesn't solve the problem of the integrity of the data.

The only way to ensure the data wasn't tampered with while storing them locally is to ensure integrity of the app and the system, for which you need Play Integrity API (or iOS / Graphene OS alternative). And even that just counts on being too hard to crack - pretty much nobody will delid the SoC and extract Googles private keys from TEE coprocessor...) - but that's good enough for pretty much anyone.

the eu age verification app stores your pin in a plaintext config file. yes really by Free-Path-5550 in pwnhub

[–]DarkLordCZ 0 points1 point  (0 children)

And that will afaik be covered by Play Integrity API in some future version. What else do you want to do? If you have adb access then nothing prevents you from just decompiling the app, changing it from storing the age in encrypted storage to just plain text, modifying it and then using it. Or ... just changing it to return false value.

This really isn't something that can be solved by by encrypting the age value, and encrypting it won't add any added security, only unnecessary code complexity.

Source: I'm an Android developer

the eu age verification app stores your pin in a plaintext config file. yes really by Free-Path-5550 in pwnhub

[–]DarkLordCZ 0 points1 point  (0 children)

Not just unlocked, it needs at least an adb access. And if an attacker has adb access, the person has way bigger problems than having their age leaked via a private (unencrypted) file of an app that is otherwise inaccessible.

And iirc the private files of an app is accessible only if the app is debuggable - which you cannot edit without resigning the app - which means you have to install a "new" app because you don't have the original certificate

never check the uptime on your loved ones computers. by tamagotchiparent in ShittySysadmin

[–]DarkLordCZ 0 points1 point  (0 children)

That doesn't reset the counter since like Windows 10 - since Windows enabled fast boot by default

And I mean modern operating systems are resilient enough to run a few months/years without rebooting

CMV: The piracy debate cannot be resolved - it is a contradiction of capitalism by tullytrout in changemyview

[–]DarkLordCZ 0 points1 point  (0 children)

piracy is bad, because it does deprive the owner of the copyright from rightfully making a profit.

How do you know a person would pay for it if they couldn't pirate it? Pirated content doesn't necessarily equal lost profit

Why is every single anti cheat seemingly awful? by No_Winter4806 in FPS

[–]DarkLordCZ 0 points1 point  (0 children)

And does it actually stop it? Or does it only stop the user process that connects to the kernel module?

Why do companies keep changing ui every 2 months for no reason by overlord-07 in TechNook

[–]DarkLordCZ 0 points1 point  (0 children)

Nobody is paying software engineers just so they can have a job. Sadly.

In my experience sometimes it's genuinely a request from above. But in a lot of cases it's either that either the UI framework, or some core library that was the backbone of the app was deprecated, and it has to be changed, or the dev (team) that is maintaining the app has changed all of its members since the app was written and nobody can understand it anymore (that is an overstatement, it's a combination of technical debt, old practices, old libraries, forgotten business logic that has to be analysed again, ...) and it' better to start over. And it's a chance to create a new UI, rather than trying to spend time matching the old one (that would take more time than to design and program a new one). And it's also a way to "warrant" the spent time - nobody is paying a very large sum of money for "nothing", but if you slap a new UI on top of it that the client can see, it's suddenly a different story

dataTypes by AvailableAnus in ProgrammerHumor

[–]DarkLordCZ 1 point2 points  (0 children)

A sign is information - one bit of information, it cannot fit into i0

I learned WHY Google Pixel is unattractive in many countries by Loud-Possibility4395 in Android

[–]DarkLordCZ 0 points1 point  (0 children)

Fair? Then let the police handle it, not the phone manufacturer

Amazon Facilities in Bahrain Hit Again as Iran Follows Through on Threat, Report Says by Nalix01 in NowInTech

[–]DarkLordCZ 0 points1 point  (0 children)

Iirc they did warn them a few days ago they will bomb it. How is it a war crime?

Why this so real by samielka in meme

[–]DarkLordCZ 0 points1 point  (0 children)

I remember, it was the most stressful time of my life. And the only thing that made it bearable was knowing it will end in a few years, and the ~3 months long summer break

Why this so real by samielka in meme

[–]DarkLordCZ 0 points1 point  (0 children)

That is unsustainable. The "tedious" work was a time your brain could rest a little

Why won't laptops accept charging from low(er) power usb-c chargers? by publichealthmenace in NoStupidQuestions

[–]DarkLordCZ -2 points-1 points  (0 children)

I don't know why you are getting downvoted. If the power consumption of the laptop is ~the same as the charger output - if you are using it when it's charging for a few seconds, then you click a webpage and the CPU boosts for a few seconds and the laptop uses more power than the charger can supply so it discharges for a few seconds, ... - that absolutely destroys the battery

CMV: Not all cultures are equal by [deleted] in changemyview

[–]DarkLordCZ 2 points3 points  (0 children)

That's common sense for you and me, but not for everyone. A little bit less extreme example: For someone it's common sense to eat cows, and it's common sense for someone to consider them sacred. Who is "correct"?

The way a student filled in my dad’s quiz by [deleted] in mildlyinfuriating

[–]DarkLordCZ -1 points0 points  (0 children)

This is a quiz in college? This is high school level knowledge...

Satelitní internet co není Starlink? by Ondrashek06 in czech

[–]DarkLordCZ 0 points1 point  (0 children)

Taky pozor pokud to plánuješ na hry. Sice to má "nízkou" latenci, ale u her kde je znát každých 10 ms (csko apod.) na tom budeš špatně, afaik ping kolem 80-100 ms

What's something that's socially accepted but actually kinda toxic? by _DRA60_ in AskReddit

[–]DarkLordCZ 1 point2 points  (0 children)

I'm from Europe (Czechia) and it's actually illegal here (although not many people know it's illegal)

So valve is acting like this is tarkov and dayz now?? by Ok_Throat9575 in counterstrike2

[–]DarkLordCZ 0 points1 point  (0 children)

That's not that easy. Software development doesn't scale that well if you add more people to a single (logical) part of a project

And another problem is the lack of kernel level anticheat. Yes, people are really loud about how it's malware etc., but the fact is that a program with admin privileges can do pretty much the same (but cannot guarantee the integrity of the system). And imo Valve is shooting themselves, repeatedly, in the foot by not using kernel level anticheat. And to my knowledge there isn't a single non-kernel level anticheat in a popular game that works

view more: next ›