Meta has banned the personal Facebook accounts for everyone on our team

Re:Meta has banned the personal Facebook accounts for everyo... by amatecha on Thursday September 29, 2022 @12:09AM (#33016219)

If you've ever worked on an online service, you might realize that what you ship for the client is almost irrelevant -- it can all be reverse engineered and an unofficial client can _always_ be created. This happens for all online services, even if it's just someone's data-mining app running on a local machine. The number one rule is "never trust what comes from the client", because it's trivial to create carefully-crafted network calls to basically do whatever the API allows (and sometimes more than what was supposed to be allowed).

So, obviously 3rd party clients are thus able to perform malicious acts, but existing laws already forbid this.

My suggestion to ensure 3rd party clients are always legally permitted isn't mutually exclusive with existing laws protecting the creators of services and software. :)

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by dangero on Thursday September 29, 2022 @12:25AM (#33016319)

You should check out Apple App Attest —- this just isn’t true any more for mobile.

https://developer.apple.com/documentation/devicecheck/valida...

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by Matheus28 on Thursday September 29, 2022 @12:33AM (#33016372)

I haven't read it thoroughly, but given the App Attest service runs on the OS, why can't someone just find the certificate for it hidden somewhere and use that to sign fake attests in userland? This is just an extra layer of obfuscation. It doesn't prevent someone from faking api calls with no app (or phone) involved.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by btown on Thursday September 29, 2022 @01:19AM (#33016730)

Given that this only runs on certain Apple hardware, I wouldn’t be surprised if the Secure Enclave holds that certificate and can confirm at an extremely low level that it is being used only to sign a hash of of the app code itself and a shared secret with the app developer.

Brilliant, in a scary way. In a way it makes data portability regulations all the more important.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by Matheus28 on Thursday September 29, 2022 @01:37AM (#33016836)

From my quick reading of the docs:

It generates a public-private key pair that is stored in the secure enclave, then it sends that public key (or the hash maybe) to Apple for them to sign. The rest of the stuff is as you expect.

One could simply figure out how the request to apple is made to get them to sign a key, and that's that. Get them to sign a key and pretend to be the app from now on.

I guess this prevents spam from someone signing thousands of keys using a specific phone's serial number, though. Assuming there's an unique public-private key for each phone apple makes, one can't simply get them to sign keys with random serial numbers.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by origin_path on Thursday September 29, 2022 @03:35AM (#33017554)

The way these schemes usually work is that the pairing is done at the factory. Apple switch the iPhone on for the first time as it's being made, it generates a private key that never leaves the secure chip and then presents the public key. The public key is then signed to create a certificate chain and the certs handed back to the device for storage.

So, there's no way to beat it except by extracting a private key, or by using some software exploit to confuse it into signing the wrong thing.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by Nextgrid on Thursday September 29, 2022 @05:22AM (#33018168)

You don't need to extract the private key though, just use it to sign things. So if you have shell access on the phone, you can tell the SE to sign the request you want.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by origin_path on Thursday September 29, 2022 @11:25AM (#33022000)

Only to some extent. Apple work very hard to prevent that from being possible, and it's not necessarily signing just anything the app processor sends. Usually this stuff is integrated with the bootup process.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by d110af5ccf on Thursday September 29, 2022 @01:34AM (#33016818)

It isn't true for iOS devices, perhaps. I refuse to run an OS that supports such nonsense. Right now a custom Android rom is sufficient. In the future I expect I'll be moving to one of the Linux distros once they have better support for mobile.

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by a_t48 on Thursday September 29, 2022 @12:34AM (#33016379)

Does still this work on jailbroken phones where you can let apps modify the memory of other running apps (ala CheatEngine)?

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by xvector on Thursday September 29, 2022 @12:12AM (#33016243)

"Never trust the client" is true, but in practice, some control over the client still helps reduce abuse if you make third party clients a lot harder (eg remote attestation.)

[ Parent | on HN ]

Re:Meta has banned the personal Facebook accounts for everyo... by rootw0rm on Thursday September 29, 2022 @12:34AM (#33016388)

back when MechWarrior Online was still pretty new, I reversed the login app (100% .Net, very little obfuscation) which allowed me to access test servers that were testing an unreleased map. Fun times

[ Parent | on HN ]