ridafkih

7 ms·

1.
by ridafkih 3y ago
Since the Messenger Application on desktop is much closer to the usage model of the Texts.com client. We want to replicate the desktop client as closely as possible. It can be assumed there’s going to be properties that are unique to the de
2.
by ridafkih 3y ago
This only works on Android, we had no interest in intercepting the Android application.
3.
by ridafkih 3y ago
Their Android application in particular allows the participation in a developer program which allows access to one of these menus. Not available on macOS and iOS unfortunately!
4.
by ridafkih 3y ago
Fair! In that case, yes you totally have access to the payload before its encrypted.
5.
by ridafkih 3y ago
Good question, Proxyman is the one I'm using in the writeup. It does route all application through it on macOS, and you can proxy iOS devices as well by installing a self-signed certificate on the device and connecting it through the p
6.
by ridafkih 3y ago
It prevents attack vectors that involve attacker-owned certificate authorities as well as compromised certificate authorities from exposing user-data. https://sslmate.com/resources/certificate_authority_failures
7.
by ridafkih 3y ago
Not the case with asymmetric encryption, you could encrypt with a public key and only the server's private key would be able to decrypt it. Not even the client could.
8.
by ridafkih 3y ago
You're right, it probably could have been implemented by only assigning the output of the sandbox flag function in the consumer function to true, but in this case it worked fine. :)
9.
by ridafkih 3y ago
I will say that ChatGPT did a decent job of explaining non-documented instructions in prior attempts of binary patching. Now if I could feed an AI a binary and have it tell me where what is happening in a very broad scope, that'd be a
10.
by ridafkih 3y ago
It's probably a matter of priorities, as well as cost v. benefit. Obfuscation would've had very little effect on the outcome of this experiment, but might've changed the approach to involve dynamic instrumentation a little mo
11.
by ridafkih 3y ago
> With Meta’s Messenger application for macOS being so close to the Texts.com model—that being a standalone desktop application—Batuhan İçöz who is leading the Meta platform project at Texts.com thought we could gain some valuable insigh
12.
by ridafkih 3y ago
Snapchat and TikTok both boast pretty gnarly RE-prevention measures.
13.
by ridafkih 3y ago
This was initially an internal post at Texts.com that we decided to share, and I scrapped mention of the fact I had tried the exact same approach a few weeks prior and reached my time-box as well. I initially spent two hours trying to modif
14.
Sunbird / 'Nothing Chats' Is Not Secure(texts.blog)
3 points by ridafkih 3y ago|0 comments
15.
by ridafkih 3y ago
It acts as a linked device, and you are interfacing directly with Signal's servers with the same protocol that their desktop and mobile applications use.
16.
by ridafkih 4y ago
Author here, for the record, I never said the problem was the imposition of processes, I know that is totally necessary, and was listing great "pluses" to Jira as a management tool. Something I think I could have iterated better i
17.
by ridafkih 4y ago
Huge oversight on my part, I think I've beaten this horse to death though, and will probably leave the topic for the time-being.
18.
by ridafkih 4y ago
Author here, was just Googling my post to figure out why it was suddenly getting tons of views. FWIW I love my job, not burned out, but yeah... dealing with Jira has been a serious pain in the butt, especially coming from Linear.
19.
by ridafkih 4y ago
Well put. Seriously.
20.
by ridafkih 4y ago
It shouldn't hijack it, but you're the second to complain on this specific topic, so I went ahead and removed it on the blog post screens. I was initially trying to figure out if someone was DDoS'ing my website, but it seems
21.
by ridafkih 4y ago
Was trying to figure out why my website randomly got way above its normal daily usage, looks like I found it. FWIW, I went ahead and removed it on the blog post pages.