Skip to content

Google Play’s latest security change may break many Android apps for some power users. The Play Integrity API uses hardware-backed signals that are trickier for rooted devices and custom ROMs to pass.

Technology
75 46 10
  • 42 Stimmen
    11 Beiträge
    35 Aufrufe
    P
    That takes zero ingenuity.
  • 206 Stimmen
    34 Beiträge
    104 Aufrufe
    remotelove@lemmy.caR
    I looked into that and the only question I really have is how geographically distributed the samples were. Other than that, It was an oversampled study, so <50% of the people were the control, of sorts. I don't fully understand how the sampling worked, but there is a substantial chart at the bottom of the study that shows the full distribution of responses. Even with under 1000 people, it seems legit.
  • 63 Stimmen
    2 Beiträge
    11 Aufrufe
    J
    Very clever.
  • 424 Stimmen
    80 Beiträge
    170 Aufrufe
    S
    It really depends on the company. Some look for any way to squeeze you. Others are pretty decent and probably more efficient as they dont waste as many working hours on bullshit claims and claim resolution. Also if i rent a car i want things to go smoothly. I got places to be. You make my life easy, ill happily pay again and do my best to make yours easy too.
  • Iran asks its people to delete WhatsApp

    Technology technology
    25
    1
    225 Stimmen
    25 Beiträge
    93 Aufrufe
    baduhai@sopuli.xyzB
    Communicate securely with WhatsApp? That's an oxymoron.
  • X/Twitter Pause Encrypted DMs.

    Technology technology
    52
    2
    257 Stimmen
    52 Beiträge
    138 Aufrufe
    L
    There may be several reasons for this. If I had to guess, they found a critical flaw and had to shut it down for security reasons.
  • Large Language Models Are More Persuasive Than Humans.

    Technology technology
    3
    1
    11 Stimmen
    3 Beiträge
    21 Aufrufe
    D
    aka psychopathy is a natural advantage for managers.
  • 1 Stimmen
    8 Beiträge
    31 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.