Related
http://www.artfulbits.com/Android/antipiracy.aspx
If your a Dev please support them, if you need assistance msg me i can send u code that will allow your app to automatically send a message to this company with a users information that has stolen your app or tried to steal it.
pentace said:
http://www.artfulbits.com/Android/antipiracy.aspx
If your a Dev please support them, if you need assistance msg me i can send u code that will allow your app to automatically send a message to this company with a users information that has stolen your app or tried to steal it.
Click to expand...
Click to collapse
I'm all for cracking down hard on piracy, but there are three big flaws with this solution:
1) How would Artfulbits verify that an app reporting a device is a "dark" device is making that report in good faith? If a bunch of pirates wanted to render this service pointless, they could just create apps that flood the service with false positives.
2) It is possible (although difficult) to link IMEI to a user/owner. This makes a publicly accessible database of "dark" IMEIs somewhat shady in terms of being a breach of privacy.
3) Finally, if this service is to be useful, apps have to have some way of acting on the information in the database. That is just going to lead to folks "cracking" apks to remove the IMEI-checking routines, or simply using leakproof firewalls to prevent the app from accessin the IMEI database.
Thoughts?
There is not going to be a way to completely stop piracy. Google just needs to step up the way the market works to prevent some of the piracy.
I understand devs deserve money for their hard work (and the log of my google checkout shows I support them) but I personally dont want any app reporting any information about myself or my phone. If there is a list of which apps do I will find an alternative for better or worse and not use the app. Not to knock on those who support this method, I just personally dont like it.
rondey- said:
There is not going to be a way to completely stop piracy. Google just needs to step up the way the market works to prevent some of the piracy.
I understand devs deserve money for their hard work (and the log of my google checkout shows I support them) but I personally dont want any app reporting any information about myself or my phone. If there is a list of which apps do I will find an alternative for better or worse and not use the app. Not to knock on those who support this method, I just personally dont like it.
Click to expand...
Click to collapse
Well considering my app has been pirated 3x as much as it has been downloaded legally i would be willing to let go of the few that are not comfortable with their imei being registered on a website which only happens if u are stealing an app, most apps out there gather more information from you than that without you even knowing.
I don't get why people would install this program. If it detects pirated software on your phone then who the hell are you letting you use your phone? Lets say you know you have pirated software well then of course you wont install this program. If you know your running a clean rom and have no reason to suspect pirated software your giving up a lot of information for a false sense of security. So unless this is forcibly installed on everyone's phone I don't see what's the point.
psychoace said:
I don't get why people would install this program. If it detects pirated software on your phone then who the hell are you letting you use your phone? Lets say you know you have pirated software well then of course you wont install this program. If you know your running a clean rom and have no reason to suspect pirated software your giving up a lot of information for a false sense of security. So unless this is forcibly installed on everyone's phone I don't see what's the point.
Click to expand...
Click to collapse
It's not a program you install. It is a database. App developers write routines into their programs which access the database. If an application suspects that it was illegally pirated, then it will send the user's IMEI to the database.
This is stupid idea. Go to the source of piracy if you want to fight it.
Give people access to paid apps on market and they won't download illegal copies form rapidshare...
su27 said:
Give people access to paid apps on market and they won't download illegal copies form rapidshare...
Click to expand...
Click to collapse
Riiiight... because if you give pirates the option to pay they'll definitely all pay right?
This database thing bothers me.
Not because I might be stealing programs..
but because I might find one and not know its "dark"
Suddenly I'm on some blacklist because I thought an app was cool?
I just did a search on one of the torrent sites, and found a file to DL.
It has 231 apk files and 2 .bak files. (I'm assuming the bak files are for a cracked version of the paid apk) but many of these files are a)old versions or b) free already.
Normally I would say SCORE! I don't have to DL to the g1, then back up, uninstall, transfer to the pc, and store.
Last time I tried a file like that, more than half were for cupcake, and would not work on my donut. Recycle bin.
With this Database I would get tagged as a cheater the first time I tried to install any of those files that were marked. But I have no idea they are "dark" before hand.
While I thank the Dev's for the work they do.
{Seriously, Thank you Developers!}
I'm a student, and I'm poor, which means I'm cheap.
I have several free apks stored away. Hell, I still used youtube downloader 1.2...until it quit working last week. Why, because I don't want to spend money just to have a cool phone.
If you really want to make it hard on the thieves... someone make a program that cripples another program, until the user requests the full version. Then it reads the Imei number from the phone and sends an upgrade request to a server. The server requests payment. Server verifies payment. The server issues a hashed password based on the Imei, which is then sent back to the phone as a password. Customer never sees the password.
This is what Doc to go appears to do. I could be wrong.
Now make it so that program can be imbedded in any other program.
Now thieves need a whole crap load of hacking to find enough hashed passwords to find the hash.
If the hash is added to at random intervals, or a different hash is used based on the Imei number, they might never find the hash.
Besides that, how the heck does a program know if it has been stolen?
How can it tell between a stolen program and a wiped phone that is getting reinstalled with backed up apk's?
jashsu said:
I'm all for cracking down hard on piracy, but there are three big flaws with this solution:
1) How would Artfulbits verify that an app reporting a device is a "dark" device is making that report in good faith? If a bunch of pirates wanted to render this service pointless, they could just create apps that flood the service with false positives.
Click to expand...
Click to collapse
Exists several strategies, for example the most popular is "honey pot" strategy. When vendor especially making leak of software or prepare specially application to track piracy.
jashsu said:
2) It is possible (although difficult) to link IMEI to a user/owner. This makes a publicly accessible database of "dark" IMEIs somewhat shady in terms of being a breach of privacy.
Click to expand...
Click to collapse
For example in our country sufficient IMEI of the phone to find it owner and it location, of course if you have police under your shelders. That is why I am thinking that IMEI is a good identifier.
jashsu said:
3) Finally, if this service is to be useful, apps have to have some way of acting on the information in the database. That is just going to lead to folks "cracking" apks to remove the IMEI-checking routines, or simply using leakproof firewalls to prevent the app from accessin the IMEI database.
Thoughts?
Click to expand...
Click to collapse
Solution is not perfect, but can be easily enhanced. HTTPS protocol with certificate checks will make firewalls and redirections useless.
What functionality exactly you have in mind?
[email protected] said:
While I thank the Dev's for the work they do.
{Seriously, Thank you Developers!}
I'm a student, and I'm poor, which means I'm cheap.
I have several free apks stored away. Hell, I still used youtube downloader 1.2...until it quit working last week. Why, because I don't want to spend money just to have a cool phone.
Click to expand...
Click to collapse
Leave according to your money. what can I say... spend less, work more.
[email protected] said:
Besides that, how the heck does a program know if it has been stolen?
How can it tell between a stolen program and a wiped phone that is getting reinstalled with backed up apk's?
Click to expand...
Click to collapse
Several simple steps:
- install software only from well known web sites, Android Market, Handagoo, SlideMe, etc.
- try to use trials and if it does not exists but you want to try, contact with developers. In most cases developer will provide you version for testing.
- if your phone is placed into black list, then you can contact "blacklist" vendor for explanation and fixing.
jashsu said:
Riiiight... because if you give pirates the option to pay they'll definitely all pay right?
Click to expand...
Click to collapse
You see - that's your problem - you want to fight the enemy instead of prevent war.
In my country there are many people who would pay for android programs because they are quite cheap. But we have no access to paid market. That is why we download apps illegaly.
Now, what do you think will faster stop us from stealing apps:
A. Calling us pirates and thieves
B. Giving us access to paid apps
su27 said:
Now, what do you think will faster stop us from stealing apps:
A. Calling us pirates and thieves
B. Giving us access to paid apps
Click to expand...
Click to collapse
You are making the incredibly flawed assumption that piracy only happens because people have no access to the paid market. Are some people put in this situation? Yes, probably. But the majority of pirates likely DO have access to the paid market and simply don't want to pay.
I am a bit confused, what does this ban people from? The market in it's entirety?
If that is the case, I would think you'd see an outburst of pirating once people couldn't access the market anymore. And that would also prevent people who may not feel like dishing out $100 for a navigation solution from purchasing numerous $1-10 programs that they would actually use on a daily basis. I think this methodology is flawed.
Piracy will never be completely stopped. However, making it harder for people to pirate your software is the best prevention. Instead of saying "Oh, you might have installed a pirated copy of XXX on your device, so now you can't purchase any more programs legitimately, so keep on stealing!". Due diligence falls on the hands of the software creators. If piracy is something you want to prevent (or at least inhibit) for your software, create an IMEI checking device key required to be granted after receipt (and clearance) of payment. Similar to CoPilot, granted it still gets cracked - it is much harder and much less widespread, and a simple update renders it useless to those who used the cracked version (check all over these forums for people complaining about it).
Also, implement trials that don't require the user to pay for them, giving them only 24 hours to try something out before they decide they need their money back. Even Microsoft lets users go 30 days without activation (last I checked) to try out Windows. They do not (to the best of my knowledge) make great attempts to prevent their software from being copied, but instead make it harder on those who do pirate it. Blocking system updates (of course everything has a workaround or crack, but making it harder on someone is oftentimes a great deterrent), preventing new feature installation, etc.
I am not condoning piracy, nor am I condemning software publishers. Just trying to make a point, which is this:
If you take someone who has stolen a program (for whatever reason/justification they may think of) and punish them by revoking their access to purchase said program (or any other program), you have thus reinforced their reason/justification to not purchase any programs.
Now, i may be wrong here, but looking at their source code to integrate into applications, there seem to be 2 things: 1) the device has to have a data connection, otherwise the code doesnt know whether the device is blacklisted or not, at which point it defaults to assuming it isnt, which overall is a good thing for users who have paid but for whatever reason dont have network at that time, however it is easy enough to stop an application from accessing the network, or even a specific site (ie the site for your imei number on their page).
secondly, is this meant to run on the first run of an app, or every run? if it is every run then i can see people getting annoyed by the unnecessary data usage, whereas if it is only on the first run then someone still has access to all their pirated apps from before they were on the database.
please note the only coding i have done is some fairly simple C, so i could be wrong, but anyone can check this if they want: http://www.artfulbits.com/Articles/Samples/Piracy/Integration.aspx
I think that by now most people know that I don't honeycoat things, so I'll just say it... this idea is RETARDED.
1) The application needs to use the API to get the IMEI. If you start using the IMEI to blacklist phones, a minor modification to the API causes the application to always read a string of 0's. Defeated.
2) The application needs PERMISSION to read the IMEI (android.permission.READ_PHONE_STATE). If you start requiring programs to have this permission, people will simply DENY it this permission (yes, it IS possible to block a permission)... this is ESPECIALLY the case when the application has *no good reason* to read the phone state.
3) As has been mentioned before in this thread, HOW DO YOU KNOW that an application you are downloading is pirated? Many applications are FREE to download, and virtually NONE of the pirated apps are labeled as "THIS IS PIRATED".
4) Connection to the internet can be EASILY blocked. Lots of ways... firewall, hosts, permissions, etc. Again, defeated.
Oh, and to those saying crap like access to paid market won't stop piracy, NOBODY SAID IT WOULD!!! It *WILL* reduce it though, since there ARE people out there who WOULD buy apps *IF THEY COULD*.
daveid said:
I am a bit confused, what does this ban people from? The market in it's entirety?
Click to expand...
Click to collapse
Read the description again more carefully. This does not impact a user's ability to access the Market, as it is not a Google product. In case your comprehension is lacking, i'll explain it very simply:
1. A developer decides to use the Artfulbits Anti Piracy Database (shortened AAPD) with its app.
2. A user downloads this AAPD-enabled app from the market.
3. When said app is run, it sends the IMEI of the device to the Artfulbits server. The server returns a color code corresponding to the number of times that IMEI has been reported by other AAPD-enabled apps for piracy. The app can then do whatever it wants with that information. This can be anything from deleting itself to crippling its own functionality.
4. App can also detect if has been pirated (by checking to see if the app has an entry in the user's personal Market account or some other method). If the app detects it is pirated, it will send a report to AAPD.
Another point Artfulbits failed to consider is that not all Android devices will have IMEIs to report.
Is piracy really that much of a problem? I mean most apps cost <3€ and I don't think I am the only one who values his time higher than saving 3€. I rather pay once and get updates via Market than check warez-sites for updates, and I think that most think that way?
There are just two apps that I ever considered to pirate. One was a dictionary for 20$ but I ended up buying it. The other is CoPilot which I would never buy since I don't own a car, but since it is not cracked anyway, I was not forced to really think about it.
I don't see anything good coming from that database. I.e. if my phone would be entered by mistake, you can imagine what problems that would cause for devs whose apps I bought, which I assume would suddenly stop working then.
You really need to think about whether the negative side-effects of such measures like this database are worth the (presumably very small) benefit.
Greetings everyone.
Ill just start off with asking the question: How many of you give 2nd, 3rd or nth thoughts about using a rooted (or, rooted and ROM'd) phone?
Now, let me explain why I am asking this question.
Earlier this week, my Google account was broken into. The attacker mass-emailed everyone on my contact list a link to a Viagra ad, of all things. It could have been worse, since my contacts and emails were left in-tact. In a furious, chaotic, post-incident rush, I was scrambling in an attempt to figure out how they obtained my password. At the time of this writing, I have come up with nothing. The first thing I thought, naturally, was a worm/trojan/virus on my PC. Several anti-virus / anti-malware / anti-root-kit scans proved to be clean.
So, I turned my sleuthing efforts towards my phone -- a Samsung Captivate, which had been rooted and ROM'd to Captivate 3.04. I had Lookout installed the entire time, and I have been using Cognition ROMs since late December of 2010. In assuming the worst, I nuked my phone, reverted back to stock and re-rooted and re-ROM'd. While rooting my phone, my virus scanner pleasantly informed me that the One Click rooting solution contained an exploit (Lotoor, I believe). Now, I completely understand that its necessary to use these exploits in order to gain access. However, it kinda got me thinking -- what else could be going into the phone that I dont know about?
Note that all ROMs and Rooters were obtained from links available from this website. I did not get them from "shady" locations.
I am realistic about this. I download and install applications from the internet frequently. I put a some faith in my virus scanners / anti-malware applications. This little incident, however, is making me a little more skeptical about what applications I run, as its difficult and time consuming to monitor every application for "phone home" activities.
The bottom line is that I do not want to sound like that I am placing blame on any of the Cognition developers (or any ROM developer). In fact, I am probably going to donate to them because the 3.04 version finally allowed me to use my GPS normally. I honestly feel like I have a smart phone now, as everything works as it should and the phone is alot snappier compared to the stock version. I am saying this even after I tried out the official Samsung Kies Froyo update, which still leaves me hanging for GPS service.
And yes, I completely understand that I could have very well downloaded something on the Android market that was infected. Even though I did not download any of the applications mentioned on the latest hotlist (really, I just dont care about "screaming sexy Japanese girls"), I could have obtained an undiscovered beast. It could also be the case that I have something on my PC that scanners just arent picking up. I may never know.
Where do you all stand on this issue? Do most ROM creators have more than one set of eyes looking at the packages that get deployed, or is that too unpractical?
Thanks in advance!
(P.S. I have searched the forum and looked at the suggested links before posting. I just didnt find anything that quenched my thirst)
nope 10 chars
Mobile security is becoming a concern and should be. Regardless of stock or rooted, there is a risk.
I don't bank on my phone, use my 'real' gmail or put sensitive info on my phone. Mobile is becoming a huge platform to mine information from.
qwertyaas said:
Mobile security is becoming a concern and should be. Regardless of stock or rooted, there is a risk.
I don't bank on my phone, use my 'real' gmail or put sensitive info on my phone. Mobile is becoming a huge platform to mine information from.
Click to expand...
Click to collapse
Isn't that the truth? I definitely have not done any mobile banking over mobile, and I don't think that I ever will. Its just scary that the attacker probably could have dug up more information about me in my emails than I care to think about.
I switched over to Google's 2-step verification system, so hopefully that will deter future attempts. Notice how I didnt say "prevent," as I dont think anything can actually stop a determined attacker short of getting rid of the phone and my gmail account. Obviously, if my phone falls into the wrong hands, I could be potentially hosed.
Check this out
http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/
cappysw10 said:
Check this out
http://www.engadget.com/2011/03/06/google-flips-android-kill-switch-destroys-a-batch-of-malicious/
Click to expand...
Click to collapse
Dilli already released a fix for this vulnerability for his 7.0 ROM. Maybe u cud get a similar one on ur custom ROM too.
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
sircaper said:
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
Click to expand...
Click to collapse
He said the email was sent to every one if his contacts. He was compromised.
That said. Use a secondary junk gmail account if at all possible on your phone. Don't install any app that asks for stupid permissions. Be very leary of any app that wants internet access regardless of who developed it. Android virus scanners are a joke, do not trust them.
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
whiteguypl said:
He said the email was sent to every one if his contacts. He was compromised.
That said. Use a secondary junk gmail account if at all possible on your phone. Don't install any app that asks for stupid permissions. Be very leary of any app that wants internet access regardless of who developed it. Android virus scanners are a joke, do not trust them.
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
Click to expand...
Click to collapse
Point taken. I don't disagree, but the odds say no. I figured he was using hyperbole and didn't really validate with every single person in his address book. The majority of spam e-mails are via spoofing.
sircaper said:
While your concerns are rational and I await the answers, I believe they are borne out of a false understanding of what happened to you. When a spam e-mail is sent "from" your e-mail account it is not always the case that the attacker has gained access to your machine or your e-mail account. Most e-mail spam is sent via smtp "spoofing" whereby an attacker can make an e-mail look like it is from anyone else. These are done by automated scripts that can find and/or generate random "from" e-mails and then send to other recipients that have been found or randomly generated. If many of your friends received the e-mail, it IS POSSIBLE your computer or account was compromised, or that other friends' accounts have been compromised such that the automated spam bot gained access to a similar address book to yours.
Just wanted to let you know that you may not have been compromised.
Anyway, I too, am interested in the vulnerabilities of these custom ROMS.
Click to expand...
Click to collapse
Thanks for the input.
As much as I would like to believe it was spoofed (and inherently making me feel better at the same time), I can say with a high degree of certainty that whoever did this had my password. How can I be somewhat sure of this? The "recent activity" list on gmail.com had an entry from a web browser access in Brazil. I do not have a proxy in Brazil, nor have I traveled there in.. well... ever. Also, the recipients' email headers claimed the email originated from gmail.com. Now, you're completely right that this part could have been spoofed, but I am not so sure about the first part. Upon doing some research, I've found that alot of other people who also had their accounts compromised had the same log entries and same origin in the email headers sent to the recipients.
Digression. Anyways, what they did is not as important as how they did it. Even to this day I am not sure. I really dont want to place blame on the ROM, because honestly the Cognition people did a fantastic job with it.
Bottom line is that I was curious as to everyone's security concerns, or lack thereof, when using custom ROMs.
How can you tell if your phone has been infected? What are some of the signs?
Hondo209 said:
How can you tell if your phone has been infected? What are some of the signs?
Click to expand...
Click to collapse
Well, I am no expert in this area, but the first place to look would be at an anti-virus, anti-malware application (such as Lookout). However, that probably wont do you any good if the virus/trojan/worm/whatever is still unknown.
Second place you might want to look is at your data usage. Excessive amounts might indicate something is up.
Other than that, maybe one of the sure-fire ways is to see which system files have changed and how. For some reason, a software package like Tripwire comes to mind. Although, I dont know how useful something like that would be on a mobile device.
Someone much more versed in this topic should have some better ideas
EggplantWizard said:
Thanks for the input.
As much as I would like to believe it was spoofed (and inherently making me feel better at the same time), I can say with a high degree of certainty that whoever did this had my password. How can I be somewhat sure of this? The "recent activity" list on gmail.com had an entry from a web browser access in Brazil. I do not have a proxy in Brazil, nor have I traveled there in.. well... ever. Also, the recipients' email headers claimed the email originated from gmail.com. Now, you're completely right that this part could have been spoofed, but I am not so sure about the first part. Upon doing some research, I've found that alot of other people who also had their accounts compromised had the same log entries and same origin in the email headers sent to the recipients.
Digression. Anyways, what they did is not as important as how they did it. Even to this day I am not sure. I really dont want to place blame on the ROM, because honestly the Cognition people did a fantastic job with it.
Bottom line is that I was curious as to everyone's security concerns, or lack thereof, when using custom ROMs.
Click to expand...
Click to collapse
Hmm.. Interesting.... I may take back my argument then!
As far as the concerns? I am also on Cognition 3.04 and up until now, I brushed aside the security issues. I had concerns, but hoped the community was strong enough to expose them. There definitely is an inherent risk downloading files authored by the developers. I know that some of them add in their own signature files just to track the programs and see if they are being altered. I'm not sure what can be done. Maybe you can run the ROM zips through a virus scanner on your pc before installing?
whiteguypl said:
P.s. "(really, I just dont care about "screaming sexy Japanese girls")" = blasphemy
Click to expand...
Click to collapse
HA! Now that's just funny.
sircaper said:
I figured he was using hyperbole and didn't really validate with every single person in his address book.
Click to expand...
Click to collapse
Well, I didnt validate with *every* single person in my address book, but I talked with a few that I speak with on a daily basis. They all had the same headers originating from gmail.com
Although, I do have to admit that one of the bizarre after-effects of such a compromise is that I have been "reunited" with people I haven't spoken to in a very long time. Take the good with the bad, I suppose.
I agree that security is a concern especially so when one is rooted. There are so many things to take into account. Even using wifi hotspots where hackers can hijack your logged in sessions whether it be Gmail, websites or banking. There are other methods where they can intercept packets with password and account information. For myself, I try and keep antivirus apps like Lookout running and scan often as well as am very cautious as to what hotspots I connect to. It doesnt look like your virus scanner helped you much. However, there may the possibility that you received malware on your PC where you may also be checking gmail from and it spoofed your account using information from there. Its all a guessing game though as there is probably no way to tell how this happened to you. I'd be thankful that it was just an ad that was sent out and nothing more serious came as a result...and change my passwords damn fast (lol)
Oh yeah, I only use wifi networks that I know. I don't log onto public wireless or random networks...
So when I first got the HTC One (on ATT) I was super pissed to find out Google Wallet or Google Hangouts (the A/V) portion was somehow disabled.
I've wanted to keep my phone stock (or stock-ish) so the most invasive thing I've tried was TrickDroid. Still no dice.
Finally, I figured that the GE edition ROMs would stop this tomfoolery, nope... still blocked.
So my questions are:
1) Are there any (hacky) ways to get this apps working?
2) Via what methods are they being block?
3) If it is truly ATT being the jerks here, does anyone want to help me create a ****-storm about this?
I know carrier blocking apps is old but coming from Tmo, this is really, really pissing me off.
No matter what you do, Google wallet wont work properly, as the One doesnt have the required secure element to run it.
As for hangouts, they are working fine for me, not sure what might be happening there...
cowmixtoo said:
So when I first got the HTC One (on ATT) I was super pissed to find out Google Wallet or Google Hangouts (the A/V) portion was somehow disabled.
I've wanted to keep my phone stock (or stock-ish) so the most invasive thing I've tried was TrickDroid. Still no dice.
Finally, I figured that the GE edition ROMs would stop this tomfoolery, nope... still blocked.
So my questions are:
1) Are there any (hacky) ways to get this apps working?
2) Via what methods are they being block?
3) If it is truly ATT being the jerks here, does anyone want to help me create a ****-storm about this?
I know carrier blocking apps is old but coming from Tmo, this is really, really pissing me off.
Click to expand...
Click to collapse
TheBishopOfSoho said:
No matter what you do, Google wallet wont work properly, as the One doesnt have the required secure element to run it.
Click to expand...
Click to collapse
Blatant misinformation. I know for a fact that you can get Google Wallet to run on the HTC One. Someone mentioned it earlier and took pictures to prove it. He even posted how he was able to do it, but I wasn't interested in rooting my phone, so I didn't look into it any further.
Oh, and as for Hangout, my HTC One came with Google Talk, and after a normal Play Store update, it changed to "Hangout" (Rogers HTC One, not rooted).
cowmixtoo said:
Google Hangouts (the A/V) portion was somehow disabled.
Click to expand...
Click to collapse
I know att announced that the av portion (video chat) will be enabled over the next few months. Starting with unlimited users and going down the line. I think it works for me now as I am on the unlimited data plan.
Also search there is a hack if rooted to allow this now. You have to modify a file.
As far as wallet. Att Verizon and t mobile have rejected wallet for there own proprietary system called Isis. Currently only available in salt lake city and Austin. www.paywithisis.com
It sucks because they have not expanded the system beyond those 2 cities in a long time.
Sent from my HTC One using xda premium
WhatsAUsername said:
Blatant misinformation. I know for a fact that you can get Google Wallet to run on the HTC One. Someone mentioned it earlier and took pictures to prove it. He even posted how he was able to do it, but I wasn't interested in rooting my phone, so I didn't look into it any further.
Click to expand...
Click to collapse
Wohah there. Unless you have a source that isn't blatent misinformation. Google wallet is not offically supported on the HTC One unless you are on the sprint network in the states. Source: http://support.google.com/wallet/bin/answer.py?hl=en&answer=1347934
As the model in question is the AT&T version he is telling the truth. Getting it to work otherwise is a hack.
WhatsAUsername said:
Blatant misinformation. I know for a fact that you can get Google Wallet to run on the HTC One. Someone mentioned it earlier and took pictures to prove it. He even posted how he was able to do it, but I wasn't interested in rooting my phone, so I didn't look into it any further.
Oh, and as for Hangout, my HTC One came with Google Talk, and after a normal Play Store update, it changed to "Hangout" (Rogers HTC One, not rooted).
Click to expand...
Click to collapse
"Blatant" misinformation? Hardly. Try googling it, only Sprint editions of the One support wallet, there are many and varied references to other One versions lacking the hardware to support Wallet in its current incarnation.
How's this?
One thing worth mentioning: The HTC One Google Play Edition doesn't come with Google Wallet -- and the app also isn't available for installation on the device via the Play Store. (Wallet is installed on the GS4 Play Edition.) A Google spokesperson tells me this is due to the One's hardware lacking an embedded secure element that Wallet requires in order to run.http://blogs.computerworld.com/android/22397/galaxy-s4-htc-one-google-play-editions
So there's a hardware deficiency on the GSM version?
Why even both putting NFC on the phone?
BarryH_GEG said:
How's this?
One thing worth mentioning: The HTC One Google Play Edition doesn't come with Google Wallet -- and the app also isn't available for installation on the device via the Play Store. (Wallet is installed on the GS4 Play Edition.) A Google spokesperson tells me this is due to the One's hardware lacking an embedded secure element that Wallet requires in order to run.http://blogs.computerworld.com/android/22397/galaxy-s4-htc-one-google-play-editions
Click to expand...
Click to collapse
cowmixtoo said:
So there's a hardware deficiency on the GSM version?
Why even both putting NFC on the phone?
Click to expand...
Click to collapse
NFC has other uses as well. You can share things easily between phones. Also some places have NFC payments without google wallet. In Canada Rogers and CIBC have teamed up and made NFC payments for the s3 (another phone without google wallet).
Google Wallet is the biggest NFC payment network for a phone. For people coming from Wallet devices (like I had the GN and the N4 before) this is an insane let down.
I would have never bought the HTC Onc and moved to ATT if this lack of functionality was made clear.
bobruels44 said:
NFC has other uses as well. You can share things easily between phones. Also some places have NFC payments without google wallet. In Canada Rogers and CIBC have teamed up and made NFC payments for the s3 (another phone without google wallet).
Click to expand...
Click to collapse
cowmixtoo said:
Google Wallet is the biggest NFC payment network for a phone. For people coming from Wallet devices (like I had the GN and the N4 before) this is an insane let down.
I would have never bought the HTC Onc and moved to ATT if this lack of functionality was made clear.
Click to expand...
Click to collapse
All it took me to look up was a quick google search. And Google Wallet is only the biggest NFC payment system in the UnS. Everywhere else does not have that option. NFC does have other uses, limited yes, but other ones.
Carrier Issue
IMO, this is a carrier's issue or fault, not HTC's.
bobruels44 said:
the s3 (another phone without google wallet).
Click to expand...
Click to collapse
dgtiii said:
IMO, this is a carrier's issue or fault, not HTC's.
Click to expand...
Click to collapse
You're both missing the point. The issue being discussed is a h/w issue where, for some reason, HTC's omitted the secure element in the NFC chip they use that Google Wallet (and any other payment systems) is dependent on. Carrier's block access to Google Wallet but if the phone's properly equipped h/w wise you can work around it. You can't work around the absence of a secure element. If you want to know what the secure element does do a Google search on "Google Wallet secure element."
BarryH_GEG said:
You're both missing the point. The issue being discussed is a h/w issue where, for some reason, HTC's omitted the secure element in the NFC chip they use that Google Wallet (and any other payment systems) is dependent on. Carrier's block access to Google Wallet but if the phone's properly equipped h/w wise you can work around it. You can't work around the absence of a secure element. If you want to know what the secure element does do a Google search on "Google Wallet secure element."
Click to expand...
Click to collapse
For the s3 I was not talking about google wallet there. I was talking about the Canadian variant of the s3. Google wallet is not available up here on any device on any carrier. That's why I was mentioning that. I may be incorect about the hardware component on that variant however my point of there are alternatives in other outcries remains.
So, is the problem with NFC a physical hardware piece, or can it be fixed with software? "Lack of a secure element" is why Verizon blocked Google Wallet on the Verizon Galaxy Nexus but that still ended up working.
dsass600 said:
So, is the problem with NFC a physical hardware piece, or can it be fixed with software? "Lack of a secure element" is why Verizon blocked Google Wallet on the Verizon Galaxy Nexus but that still ended up working.
Click to expand...
Click to collapse
You guys are confused. Here's what a secure element is and does...
If you're not familiar with how Wallet functions, it's a bit odd as an application goes. The Wallet app isn't the only "piece" necessary to get the Wallet service functioning, there are two other parts of the equation. One you're already familiar with: NFC (near-field communication). It's a simple, open wireless standard that transmits data over very short distances. In Wallet's case, it transmits payment data. But there's a third wheel in play that many people aren't aware of, and it's called a "secure element." Without getting too technical (eg, into things I don't at all understand), the secure element's job is to store encrypted credentials (your payment info) and tell the Wallet app "hey, these are the credentials you need to transmit to the payment terminal."
Only one card's credentials are stored on the element at a given time (obvious security reasons), which is why you need an internet connection if you want to switch your active card in Wallet. When you sign in to Wallet or change cards, the Wallet app calls up to the Google server, pulls down your credentials for a particular card, and then writes them to the secure element.
But one does not simply write to the secure element (... or walk into Mordor), it requires special permissions. Google Wallet is doing something few apps do - asking for direct, exclusive access to a secure piece of hardware in the phone. Not only that, once Google takes over the secure element, it wants total control. Because of the security concerns (and related technical difficulties) involved in sharing a secure element, Wallet and only Wallet is able to utilize the internal secure element on a Wallet-enabled device. That means Google is directly managing every layer of the process. http://www.androidpolice.com/2013/0...why-the-carrier-is-still-allowed-to-block-it/
People got Wallet working on the VZW GN by side-loading it; much like everyone else who's running Wallet even though it's not carrier or region supported for their particular device . VZW's beef is that they don't trust third parties to use security-enabled h/w that VZW can't control on VZW-sold devices. When VZW realized people were by-passing the process they, with Google's help, did the following...
So Google Wallet has never officially been available for Verizon, on any smartphone. However for months now users have been able to side-load Google’s awesome Wallet app for mobile NFC payments using the web store, or installing a custom ROM. Today however it appears that Google’s pulled the backend plug. http://androidcommunity.com/google-wallet-gets-pulled-from-verizon-galaxy-nexus-20120914/
If the VZW GN didn't have a secure element Wallet would have never worked. The only two phones I've heard about without a secure element are the DNA/Butterfly and the One (except apparently for Sprint).
BarryH_GEG said:
You guys are confused. Here's what a secure element is and does...
If you're not familiar with how Wallet functions, it's a bit odd as an application goes. The Wallet app isn't the only "piece" necessary to get the Wallet service functioning, there are two other parts of the equation. One you're already familiar with: NFC (near-field communication). It's a simple, open wireless standard that transmits data over very short distances. In Wallet's case, it transmits payment data. But there's a third wheel in play that many people aren't aware of, and it's called a "secure element." Without getting too technical (eg, into things I don't at all understand), the secure element's job is to store encrypted credentials (your payment info) and tell the Wallet app "hey, these are the credentials you need to transmit to the payment terminal."
Only one card's credentials are stored on the element at a given time (obvious security reasons), which is why you need an internet connection if you want to switch your active card in Wallet. When you sign in to Wallet or change cards, the Wallet app calls up to the Google server, pulls down your credentials for a particular card, and then writes them to the secure element.
But one does not simply write to the secure element (... or walk into Mordor), it requires special permissions. Google Wallet is doing something few apps do - asking for direct, exclusive access to a secure piece of hardware in the phone. Not only that, once Google takes over the secure element, it wants total control. Because of the security concerns (and related technical difficulties) involved in sharing a secure element, Wallet and only Wallet is able to utilize the internal secure element on a Wallet-enabled device. That means Google is directly managing every layer of the process. http://www.androidpolice.com/2013/0...why-the-carrier-is-still-allowed-to-block-it/
People got Wallet working on the VZW GN by side-loading it; much like everyone else who's running Wallet even though it's not carrier or region supported for their particular device . VZW's beef is that they don't trust third parties to use security-enabled h/w that VZW can't control on VZW-sold devices. When VZW realized people were by-passing the process they, with Google's help, did the following...
So Google Wallet has never officially been available for Verizon, on any smartphone. However for months now users have been able to side-load Google’s awesome Wallet app for mobile NFC payments using the web store, or installing a custom ROM. Today however it appears that Google’s pulled the backend plug. http://androidcommunity.com/google-wallet-gets-pulled-from-verizon-galaxy-nexus-20120914/
If the VZW GN didn't have a secure element Wallet would have never worked. The only two phones I've heard about without a secure element are the DNA/Butterfly and the One (except apparently for Sprint).
Click to expand...
Click to collapse
Wow. Thank you for that reply. Just one thing I'm confused about. Last year, the Galaxy S3 did not have a secure element, but the Sprint version did, so people were taking some lib files from the Sprint version, putting them on their S3s, and getting Google Wallet to work. With that in mind, does this mean that the secure element is software that could potentially be added on afterwards by, possibly, a third party source like someone on XDA, or does it have to be built into the phone initially?
dsass600 said:
Wow. Thank you for that reply. Just one thing I'm confused about. Last year, the Galaxy S3 did not have a secure element, but the Sprint version did, so people were taking some lib files from the Sprint version, putting them on their S3s, and getting Google Wallet to work. With that in mind, does this mean that the secure element is software that could potentially be added on afterwards by, possibly, a third party source like someone on XDA, or does it have to be built into the phone initially?
Click to expand...
Click to collapse
+1. Really great explanation of secure elements but I also agree. I had the galaxy s3 to mobile edition and all files, libs and what not where pulled from the sprint version and made flashable to all s3s.
Sent from my HTC One using Tapatalk 4 Beta
TheBishopOfSoho said:
"Blatant" misinformation? Hardly. Try googling it, only Sprint editions of the One support wallet, there are many and varied references to other One versions lacking the hardware to support Wallet in its current incarnation.
Click to expand...
Click to collapse
I'm glad someone already posted that link about people getting it working before I came back to check this thread. Stop misleading people. I already told you previously that I understood the lack of a secure element, but that it was still possible (at least at one point) to get it working. There's no need to put down others just because you feel so sure about your own knowledge. -.-
dsass600 said:
Last year, the Galaxy S3 did not have a secure element, but the Sprint version did, so people were taking some lib files from the Sprint version, putting them on their S3s, and getting Google Wallet to work.
Click to expand...
Click to collapse
All Samsung's NFC-equipped devices have a secure element (which is h/w). What you guys are talking about is missing s/w necessary to provide access to it. I'm guessing in the cases you're mentioning they were carrier SGS3's and the missing s/w was a carrier-requested "enhancement" specific to their SGS3. It's kind of like carrier's pulling the FM radio s/w but leaving the h/w which allows people to later get the functionality back.
http://nfctimes.com/news/samsung-embed-secure-element-galaxy-s-iii-other-nfc-phones
In the case of the DNA/Butterfly and non-Sprint One’s the physical secure element has been omitted and no amount of s/w can reverse that.
This is a pure guess on my part but HTC not providing a secure element is probably because they don't want to deal with the administration of it. Much like MAC addresses, secure elements are serialized and need to be tracked on a per-device basis which means maintaining a database and supporting Google in dealing with borked secure elements (which happens a lot). And that includes replacing the NFC chip if the secure element gets borked which would/could be a warranty claim. With so little carrier support for Wallet it's not a bad strategy as outside XDA people wouldn't miss access to it. And as far as I know Wallet's the only app that currently requires the presence of a secure element.
Is there an application that can password protect certain apps that I choose?
And please do not say Kids Corner as it does not do what I am asking.
It's probably possible (though far from easy), but I'd actually be more inclined to help if you hadn't opened a duplicate thread about this.
Only made second thread about this to attract some attention, 7 months passed since that guy opened his thread and nobody could give a good answer.
To me it's weird that nobody tried to make an app like this still, it would be very popular and help users very much.
Anyways, thank you for replying.
Really, just bumping the other thread was enough, but since we're here anyhow... my idea for how to approach it (and this would take a *lot* of hacking) goes something like this:
1. Create an app (call it X) that has the capability to launch other apps, and filesystem write access.
2. Have X take another app (call it Y) and encrypt its binaries. This prevents anybody from launching it by any means.
3. Tweak the app database to make it so that when you try to launch Y, it instead launches X and passes the id of Y as a parameter to the launcher.
4. X prompts the user for a password to Y. On getting the right one, it decrypts Y's binaries and writes them back to the correct location, then launches Y.
5. When the user (or OS) closes Y, a background process of X notes that Y is closed and re-encrypts it.
Currently we know how to do... well, some of #1, and we think the rest is possible. Given that, #2 isn't too hard. #3 is something I don't have the least notion how to do *right now* but I'm sure it's possible. #4 shouldn't be too hard given #1 and #2. #5 will be a trick - currently, apps have no way to know what other apps are running - but I'm sure it can be done.
It's a large engineering problem blocked by an even bigger research and hacking problem, though. Nothing we'll have soon. You'd never be able to publish it in the store, either, and it would only work for people with hacked phones. It's exactly the kind of *useful* thing that would be possible if Microsoft were willing to let up the restrictions on third-party developers a bit, of course, But for the time being, there are *reasons* nobody has done it yet.
Well the word that I actually was thinking after reading your post was "crap".
It seems only with time (and a whole [email protected]#$ing lot of it) will wp become a true competitor to android, but to be honest I don't think it will come to that.
Thanks for replying GoodDayToDie, I'm freakin' sad that there is no app that can suit my needs, I even tried with kids corner but the screen still needs the password entered like the normal one. Nothing really can make up for what I have in mind.
Cheers mate.
as soon as we can interop unlock all WP devices, it will be pretty easy... if you're able to provide the XAP (uncrypted of course )
i'll be able to "mod" this in for you... which app are we talking about?
@GoodDayToDie: i do'nt think he is looking for real data security here, so encrypting the whole thing shouldnt be required... i think it's more about preventing his gf to read his private messages or something like that
oh btw.: you would need a dev-unlock to deploy the modified XAP then...
tfBullet said:
as soon as we can interop unlock all WP devices, it will be pretty easy... if you're able to provide the XAP (uncrypted of course )
i'll be able to "mod" this in for you... which app are we talking about?
@GoodDayToDie: i do'nt think he is looking for real data security here, so encrypting the whole thing shouldnt be required... i think it's more about preventing his gf to read his private messages or something like that
oh btw.: you would need a dev-unlock to deploy the modified XAP then...
Click to expand...
Click to collapse
You're right tfBullet! I need it for whatsapp, photos, message and games app, mostly to prevent from friends but gf too.
I was thinking it might be possible to mod an app and add password before it can be accessed, although I have no experience in this domain. Many apps in store have this function, like wallet or prive photo apps.
My phone is dev-unlocked as I started a few days ago to study and try to create a simple app for me and my friends.
Modding an app like that would actually be quite hard, because it would break the signature and prevent the app from running. The encryption thing really isn't too hard, although you could skip it anyhow too.
If there was a way to run a program in the background that monitors when certain apps are selected and then prompts when its activated would work, but it would need an unlocked phone. And even under home brew I don't know if its possible to run apps in the background. Yet.
Sent from my Nokia 521 using XDA Windows Phone 8 App
The encryption thing really isn't too hard
Yea, but that's a little extreme. If you can create that password program that runs in the background you could probably have it watch files, apps or pretty much anything. You'd have to password protect the cofig file. And maybe if you can't remember the password after so many attempts you can have the program email the passwords to your email. Just some ideas.
Sent from my Nokia 521 using XDA Windows Phone 8 App
Running software in the background is actually shockingly easy. The trick is getting it to run with better-than-app-sandbox privileges. We're still working on that one. In the meantime, apps can't even read, much less write, to the install location of other apps.
GoodDayToDie said:
Modding an app like that would actually be quite hard, because it would break the signature and prevent the app from running.
Click to expand...
Click to collapse
@GoodDayToDie: actually these .NET apps are pretty easy to decompile, if you're willing to fix the bugs that the decompiler leaves you with...
so there is not really a need for a valid signature, if you're able to compile & sideload the app yourself
the only thing is: you need the decrypted XAP, as far as i know these get decrypted while installation and can be pulled from a interop unlocked device?!
It would be nice to get my fingers on some OEM (Nokia etc..) XAPs, to see if we can find any exploit in them
I know better than probably 95% of this forum what it takes to decompile managed code; I have reverse engineered huge numbers of apps. However, you are missing several important points.
1) Modifications like you suggest are very complicated to automate. It's certainly possible, but it's not simple.
2) Re-installing the app would be a pain. You would really want to do this as an in-place modification, and that means (for store apps) that it would still be signature-checked.
3) Not all apps are managed code; WP8 supports purely native code.
4) Even with managed code, obfuscation can make tinkering with the binary nigh-impossible.
It's just so incredibly stupid that WP is so limited. I know it's under Android big time, but I think even iOS more customizable, right?
Also, is there a message app in the store that has pass option? I searched but found nothing...
I don't believe iOS is any more customizable, no. It has some feature that WP lacks (it ought to; it's been out for years longer and Apple completely controls the hardware it runs on) but it's also missing some features that WP8 offers. In any case, this isn't the thread to have that discussion in.
GoodDayToDie said:
I don't believe iOS is any more customizable, no. It has some feature that WP lacks (it ought to; it's been out for years longer and Apple completely controls the hardware it runs on) but it's also missing some features that WP8 offers. In any case, this isn't the thread to have that discussion in.
Click to expand...
Click to collapse
But with the jailbreak and MobileSubstrate, iOS is extremely customizable, and there are tons of tweaks, that's where Apple gets its new features from
Back to topic, I think the OP would be happy with a solution that locks the "normal" user of his phone out of some apps, so it wouldn't be necessary to modify anything of it, just making the standard launcher (I don't know how it's called, but I mean when you launch the app via home screen or with a toast) ask for a password should be enough.
Make sure you put 1* reviews on your Banking apps or all apps that need updating to support face unlock, hopefully it will help speed up the development and support of face unlock on the pixel 4. I am really missing fingerprint unlock on my apps!
Demolition49 said:
Make sure you put 1* reviews on your Banking apps or all apps that need updating to support face unlock, hopefully it will help speed up the development and support of face unlock on the pixel 4. I am really missing fingerprint unlock on my apps!
Click to expand...
Click to collapse
Why? I just contacted my credit union asking for them to add support. Maybe larger national banks and stuff should have been aware and had support ready but smaller, more local institutions might just need to know that it's a thing on Android now.
Sent from my Pixel 4 XL using XDA Labs
In the Play Store, you can reach out to contact each app's development team via email. I've written to Chase, Bank of America, Mint, Credit Karma, and the other apps I use. Some developers are aware that they need to update, others aren't. Here are some of the responses I've received.
My original email (to each app):
Please update the Android app to support the biometric API so that I can use the secure face unlock on my Pixel 4! Thank you!
Click to expand...
Click to collapse
Bank of America:
Thank you for your feedback and we apologize for the inconvenience. We are working to update to the latest biometric authentication for the Pixel 4 and expect to have a supporting app shortly. For now, sign-in to the app using your online ID and password. Please look out for an app update soon.
Click to expand...
Click to collapse
Chase:
We'll be happy to review your request to update the
Android App.
Ivan, please note that the Chase Mobile App will work on
any Android smart phone or tablet running Android
operating system 5.0 (Lollipop) or higher. The minimum
operating system is 5.0 or higher. If your mobile phone
does not have the minimum requirement, the Chase Mobile
app will not be compatible.
We want our mobile app users to have the best experience
possible, so we regularly test chase.com using the most
current versions of operating systems. Since some mobile
app functionality may not work well on older operating
systems, we ask that you perform these updates. We
recommend you update your operating system and application
to the newest versions available. If your device isn't set
up to receive updates automatically, you can get the We
recommend you update your operating system and application
to the newest versions available.
We appreciate your business and thank you for choosing
Chase.
Click to expand...
Click to collapse
Credit Karma:
To determine if your Touch ID or Face ID function is turned on or off, go into your settings by clicking the icon in the top right corner of the app. The directions are the same whether you’re using Touch ID or Face ID.
If Touch or Face ID is turned on you will see a green circle with a white check mark.
If it’s turned off, simply click the empty circle and you’ll be prompted with a message stating the fingerprints or face registered on your phone can be used to access your Credit Karma account. Click “OK” to this prompt and you will be asked to enter your PIN to confirm this change.
Touch or Face ID is now turned on and you will be allowed to use this function to access the Credit Karma app moving forward.
Please note that if you log out of your account, the next time you open the app you’ll be prompted to enter your email address and password.
Thanks so much,
Click to expand...
Click to collapse
I've been sending further follow-ups to the ones who clearly don't understand what we are asking.
The more people who contact them, the more they'll understand that their apps are the problem by not using the current API.
I think Chase already stated that they were going to have an update before the end of the year. Hopefully sooner rather than later.
Robinhood works!
btonetbone said:
In the Play Store, you can reach out to contact each app's development team via email. I've written to Chase, Bank of America, Mint, Credit Karma, and the other apps I use. Some developers are aware that they need to update, others aren't. Here are some of the responses I've received.
My original email (to each app):
Bank of America:
Chase:
Credit Karma:
I've been sending further follow-ups to the ones who clearly don't understand what we are asking.
The more people who contact them, the more they'll understand that their apps are the problem by not using the current API.
Click to expand...
Click to collapse
Very nice work, I have left reviews and also contacted all my Banks via email. Hopefully it speeds up the process.
Throwing up a bunch of one-star reviews won't help, and all it serves to do is make the rater (you) look petty and childish. I'll send an email to my institutions, like a grownup, and go from there.
Getting in contact directly works best, via the play store will get you to the android app devs. I usually go through Twitter and you get a spokesperson who wouldn't know an apk from an adb and will give a stock response of soon™.
Remind them that the old biometric APIs are deprecated and that they should update to current versioning. Should anything happen they don't want to be the story of the bank that wasn't able to keep up.
Honestly I'm not missing it that much for my bank that much because I use LastPass which autofills it quickly. I do miss it for Outlook though because I have to do a pin.
Sent from my Pixel 4 XL using Tapatalk
So Far E-Trade has been updated to the Pixels face Unlock... I sent an email via the app store also to a credit union hoping they will update their app. I'm hoping within the next 2 weeks to a month that all major banks will update...
How secure if this anyway? I mean, my banking account has a password. I enter that password in my banking app to log into my account. In the future I will use my facial scan to log into my banking app.
Does that mean my banking account will have two password (1x password + 1x facial scan) oder will my password be stored somewhere in the app or on android and simply be passed on the my facial scan is verified?
Both do not sound very secure to me.
If you don't feel it's secure then just don't use the app.. simple. I trust that the banks know the risks and have mitigated them. After all they are the ones on the hook if there's fraud.
bobby janow said:
If you don't feel it's secure then just don't use the app.. simple. I trust that the banks know the risks and have mitigated them. After all they are the ones on the hook if there's fraud.
Click to expand...
Click to collapse
Not really the informative answer I was looking for.
I wouldn't blindly trust a bank app or any of the other countless apps that would use my facial scan.
What happens if your facial scan gets stolen / leaked. Everyone with that information will for ever be able to access your data. And you can't even change your access code like you would be able to with a password.
And it seems like you also have no idea where your facial scan is being saved, and how it is secured / locked down. Maybe it is just a plain file on your phone's storage? You don't seem to know.
Why no simply write down all your passwords in a .txt file and save it on your sdcard? That would alteast have the advantage that you could change your password at some point.
Utini said:
Not really the informative answer I was looking for.
I wouldn't blindly trust a bank app or any of the other countless apps that would use my facial scan.
What happens if your facial scan gets stolen / leaked. Everyone with that information will for ever be able to access your data. And you can't even change your access code like you would be able to with a password.
Click to expand...
Click to collapse
Isn't the face unlock for that device only? It's not like someone can install your bank app on their phone, somehow use your face unlock information, and spoof you on that device. Also there's still 2 step verification, at least with my bank, so the new app would still need to get the verification code. If anything, it's easier to do with your password because that's something that can be typed in and then somehow get the verification code text.
Sent from my Pixel 4 XL using Tapatalk
Utini said:
Not really the informative answer I was looking for.
I wouldn't blindly trust a bank app or any of the other countless apps that would use my facial scan.
What happens if your facial scan gets stolen / leaked. Everyone with that information will for ever be able to access your data. And you can't even change your access code like you would be able to with a password.
Click to expand...
Click to collapse
I'm not sure of the question you are asking. It seemed rhetorical to me basically commenting on how you don't think fingerprint, facial or password entry is secure on your app. I don't think any of it is stored in the cloud but nonetheless it's probably not as secure as walking into your bank and transacting with a teller. Even websites probably aren't as secure as you wish they were. So what exactly are you asking that you expect a reply to? You can perhaps check with your bank as to what your liability would be if your account got hacked.
EeZeEpEe said:
Isn't the face unlock for that device only? It's not like someone can install your bank app on their phone, somehow use your face unlock information, and spoof you on that device. Also there's still 2 step verification, at least with my bank, so the new app would still need to get the verification code. If anything, it's easier to do with your password because that's something that can be typed in and then somehow get the verification code text.
Sent from my Pixel 4 XL using Tapatalk
Click to expand...
Click to collapse
Oh is it? That makes it defeniately more secure. But then I would still like to know how it is ensured that my facial scan only works with my specific mobile device and not with any other mobile device.
Yep for banking there is still 2 step verficiation. Good point. But I was actually thinking more about e.g. KeePass.
bobby janow said:
I'm not sure of the question you are asking. It seemed rhetorical to me basically commenting on how you don't think fingerprint, facial or password entry is secure on your app. I don't think any of it is stored in the cloud but nonetheless it's probably not as secure as walking into your bank and transacting with a teller. Even websites probably aren't as secure as you wish they were. So what exactly are you asking that you expect a reply to? You can perhaps check with your bank as to what your liability would be if your account got hacked.
Click to expand...
Click to collapse
Maybe I didn't explain my question good enough. I will try again:
Currently I would unlock e.g. my KeePass Database with a password.
In the future I would use my facial scan for that.
I wonder at what point my facial scan will access my password of the KeePass Database, because it somehow has to know my password in order to unlock KeePass?
And in that case my password suddenly isn't saved only in my head anymore but also within android or another app (because Face Unlock has to somehow know it?).
Or will my KeePass database get a second "password" which is my facial scan data?
In that case I want to make sure that my facial scan is very secure and can't be stolen. Because if it turns up in smth like "haveibeenpwnd.com" everyone will forever be able to access all my files with my leaked facial scan which I cannot even change to something different anymore.
Utini said:
Maybe I didn't explain my question good enough. I will try again:
Currently I would unlock e.g. my KeePass Database with a password.
In the future I would use my facial scan for that.
I wonder at what point my facial scan will access my password of the KeePass Database, because it somehow has to know my password in order to unlock KeePass?
And in that case my password suddenly isn't saved only in my head anymore but also within android or another app (because Face Unlock has to somehow know it?).
Or will my KeePass database get a second "password" which is my facial scan data?
In that case I want to make sure that my facial scan is very secure and can't be stolen. Because if it turns up in smth like "haveibeenpwnd.com" everyone will forever be able to access all my files with my leaked facial scan which I cannot even change to something different anymore.
Click to expand...
Click to collapse
I used LastPass and I think it's not different then when I died the fingerprint option for it. There's a master password for the account and biometric login is, again, just for the individual device. And again, there's 2 step verification at least with LastPass, for whenever you set up.
Sent from my Pixel 4 XL using Tapatalk
EeZeEpEe said:
I used LastPass and I think it's not different then when I died the fingerprint option for it. There's a master password for the account and biometric login is, again, just for the individual device. And again, there's 2 step verification at least with LastPass, for whenever you set up.
Sent from my Pixel 4 XL using Tapatalk
Click to expand...
Click to collapse
Sounds interesting and secure. Now I am interested in how it is ensured that my fingerprint / facial scan will only work with my specific mobile device and that the stolen data from my device can't be used from another device
Utini said:
Oh is it? That makes it defeniately more secure. But then I would still like to know how it is ensured that my facial scan only works with my specific mobile device and not with any other mobile device.
Yep for banking there is still 2 step verficiation. Good point. But I was actually thinking more about e.g. KeePass.
Maybe I didn't explain my question good enough. I will try again:
Currently I would unlock e.g. my KeePass Database with a password.
In the future I would use my facial scan for that.
I wonder at what point my facial scan will access my password of the KeePass Database, because it somehow has to know my password in order to unlock KeePass?
And in that case my password suddenly isn't saved only in my head anymore but also within android or another app (because Face Unlock has to somehow know it?).
Or will my KeePass database get a second "password" which is my facial scan data?
In that case I want to make sure that my facial scan is very secure and can't be stolen. Because if it turns up in smth like "haveibeenpwnd.com" everyone will forever be able to access all my files with my leaked facial scan which I cannot even change to something different anymore.
Click to expand...
Click to collapse
Oh I see now. This really has more to do with your password manager than the bank. Unfortunately, I don't use a PM even though I suppose I should. Everyone says it's pretty secure. Since I don't really know what I'm talking about at this point I'll give it a shot anyway. lol
I don't think the facial scan or the fingerprint scan is saved anywhere other than your device. But I do use fingerprint (or did) scans on my banking app. If I change my password on the banking site my fingerprint scan will no longer work on the app. I would first have to change my password on the app and then reregister my fingerprint when the new password is entered. Can we compare it to the face scan at this point? I mean you can't change your fingerprints either right? Before I go on, am I reading your concerns correctly?
Utini said:
Sounds interesting and secure. Now I am interested in how it is ensured that my fingerprint / facial scan will only work with my specific mobile device and that the stolen data from my device can't be used from another device
Click to expand...
Click to collapse
https://support.google.com/pixelphone/answer/9517039?hl=en
Maybe this confirms it?View attachment 4860867
Sent from my Pixel 4 XL using Tapatalk