Re:Critical Vulnerability: AWS Credential Disclosure
by labguy10001 on Monday April 07, 2014 @02:22PM
(#7548262)
The key problem is, Android is a front-end technique. Everything you put in code/resource is transparent. But so many developers treat it like back-end and believe it's save to put sensitive info inside...
[ Parent
| on HN ]
Re:Critical Vulnerability: AWS Credential Disclosure
by revelation on Monday April 07, 2014 @02:49PM
(#7548475)
The key problem is thinking anything the client does is secure, or even worse, that it may be trusted. A developer that hasn't grasped this very simple fact will inevitably not only screw up the client side (i.e. exposing AWS credentials), but also the server side.
Re:Critical Vulnerability: AWS Credential Disclosure
by yogo on Monday April 07, 2014 @03:17PM
(#7548669)
Exactly, rule number 1 is always that client data cannot be trusted.
Re:Critical Vulnerability: AWS Credential Disclosure
by gtaylor on Monday April 07, 2014 @02:47PM
(#7548459)
This isn't specific to Android, as you can pull symbols out of many kinds of binaries with some work.
Being silly with you credentials can hurt you, regardless of the platform or using a compiled or interpreted environment.
Re:Critical Vulnerability: AWS Credential Disclosure
by majiaguan on Monday April 07, 2014 @03:02PM
(#7548564)
I believe this vulnerability is existing for IOS apps, too. Trustlook they may only focus on Android
Re:Critical Vulnerability: AWS Credential Disclosure
by jug6ernaut on Monday April 07, 2014 @03:25PM
(#7548731)
This vulnerability exists with EVERY client application. It is just much easier to obtain the applications with android(as opposed to IOS) which is the only reason i can assume Trustlook focused on android.
This isnt as much a "vulnerability" as it is a complete miss understanding of security and the technology they are using. Everything on the client side should be assumed as obtainable.