News for hackers. Stuff that matters.
Re:FBI Child ID App by eddieroger on Wednesday July 06, 2022 @09:27AM (#32000527)
There's no way of saying it without sounding sarcastic that yes, this feels like a scam, if not just a bad idea. The fact that they have to come out and say, "no, we're not storing pictures of your kids" doesn't help. The idea of the app is sound, and one would hope you could trust the Federal Government with such information (like they don't have it already), but the iOS6 era screenshots and verbiage feel like a real scam.
Re:FBI Child ID App by giancarlostoro on Wednesday July 06, 2022 @09:30AM (#32000574)
I think this might be abandonware.
Re:FBI Child ID App by andymockli on Wednesday July 06, 2022 @11:11AM (#32002176)
From page source: <meta name="DC.date.created" content="2018-01-24T18:18:24+00:00">
Re:FBI Child ID App by Silica6149 on Wednesday July 06, 2022 @09:30AM (#32000590)
Their news site looks like abandonware.
Re:FBI Child ID App by Silica6149 on Wednesday July 06, 2022 @09:30AM (#32000576)
I agree the design is definitely outdated. It's also hilarious that it's exactly the kind of look I would've expected from an app released by the FBI.
Re:FBI Child ID App by mminer237 on Wednesday July 06, 2022 @09:31AM (#32000591)
It would be pretty easy to do a packet inspection and see if they're telling the truth about not transmitting the photos.
Re:FBI Child ID App by bbarnett on Wednesday July 06, 2022 @09:53AM (#32000900)
And how does one do packet inspection:

* if packets are only sent via carrier, not wifi

* if packets are sent to aws instances, which is very common

* if it all stops when phone is rooted, which is common for many apps

Re:FBI Child ID App by gzer0 on Wednesday July 06, 2022 @10:53AM (#32001890)
* deep packet inspection of carrier based communications is a thing [1].

* Gov't is mandated to use AWS Gov instances which are quite easy to distinguish [2].

* there are ways to bypass those rootchecks to make a rooted phone seem not rooted [3].

[1] https://en.wikipedia.org/wiki/Deep_packet_inspection#United_...

[2] https://aws.amazon.com/blogs/security/aws-govcloud-earns-dod...

[3] https://stackoverflow.com/questions/68661134/root-detection-...

Re:FBI Child ID App by dragonwriter on Wednesday July 06, 2022 @01:29PM (#32004108)
> Gov't is mandated to use AWS Gov instances which are quite easy to distinguish

That's not, in fact, true. The certifications that apply to AWS Gov make it easier to meet certain government compliance rules that apply to certain categories of data, but it is possible to meet the standards on a platform that isn't certified or certified to a lower level (but it means more administrative work for the org using the platform) and many Commercial AWS offerings have FedRAMP certifications, anyhow. I work in an org touched by FedRAMP, and which is almost entirely on AWS commercial, not Gov.

Re:FBI Child ID App by samatman on Wednesday July 06, 2022 @01:21PM (#32004005)
Consider that AWS Gov can offer a service disguising instances as ordinary.

Consider that they wouldn't have to tell us, indeed, might face criminal penalties for disclosing it.

Conclusion: the FBI can do this.

Re:FBI Child ID App by bayesian_horse on Wednesday July 06, 2022 @09:33AM (#32000618)
The app seems like a great idea and there honestly seems to be no particular reason why the FBI had to make it.

In the case of a child disappearing, it could save a lot of time.

Re:FBI Child ID App by eddieroger on Wednesday July 06, 2022 @09:42AM (#32000760)
If I was going to download /any/ app from the App Store in which to store pictures and factual data about my kids, I would hope I could trust the FBI more than Joe's App Shack or another anonymous developer. But in this case, if they're not going to tend to their app and it's marketing site, hard pass.