Conversation

Replying to

@fs0c131y

This is a good summary of the app

Baptiste Robert

@fs0c131y

Nov 26, 2018

This app is full of 3rd party SDKs...

Baptiste Robert

@fs0c131y

Nov 26, 2018

This is a React Native app, they used this tool to create their app

github.com

GitHub - friendsoftheweb/catalyst: An opinionated tool for creating and maintaining React applica...

An opinionated tool for creating and maintaining React applications - GitHub - friendsoftheweb/catalyst: An opinionated tool for creating and maintaining React applications

Baptiste Robert

@fs0c131y

Nov 26, 2018

Set the allowBackup to FALSE, I said FALSE

Baptiste Robert

@fs0c131y

Nov 26, 2018

Why? If you are storing valuable data in the user device, having allowBackup to true is a problem.

Replying to

I fully disagree. Apps that do that are a pain to setup again… And adb is authenticated nowadays, and hasn't had a CVE for while…

Replying to

So much stupidity in one tweet... Everything in your tweet is false... Seriously

Replying to

I was respectful in disagreeing. What is false then and why ? There's no TOFU with ADB requiring unlocking the device? There were new CVEs recently attacking unauthorized adb?

Replying to

- "adb is authenticated": Simply false. There is no authentication required for adb. - The flag allowBackup to true is a very well known vulnerability, there is plenty of CVE (ex nvd.nist.gov/vuln/detail/CV)

Replying to

and

You misunderstand the subject here. Sure you need to have a physical access to the device and activate the dev options to have ADB but still there is no authentication in ADB

Replying to

and

The device does need to be unlocked for that and similarly to accept a host's key and then to confirm a backup. It's true that it doesn't require that the user authenticates themselves beyond the device being unlocked. Enabling developer options for 1st time does require it now.

5:12 AM · Nov 27, 2018Twitter Web Client

Replying to

and

I think the main issue with app backup security is the cloud backup aspect. Cloud backups get enabled on devices with Play when the device is first set up unless the user explicitly opts out. It can then sync app data from Google's servers to any device connected to the account.