Cover photo
Alessio Moscatello
Works at Magneti-Marelli
Attended Polytechnic University of Turin
Lived in Torino
61 followers|9,741 views


Alessio Moscatello

Shared publicly  - 
CyanogenMod encrypted Device Finder!!
Technical Details on +CyanogenMod Device Finder

The new +CyanogenMod Device Finding service creates a secure connection between your browser (javascript) and your phone.

The server never has your password. Your authentication is a derived password.
A public key is generated in the browser, and hmac'd with the actual password (unavailable to the server).
On a device find request, the Android device receives this public key, and validates it is authentic, as the Android device also has the same, underived/original, password.
The Android device sends back an encrypted symmetric key using the public key.
The server can not decrypt the symmetric key, as it does not have the private key.
The browser receives the encrypted payload, and decrypts the symmetric key.

The browser and phone at this point have a secure communication channel, and both sides have authenticated each other. The server is not capable of listening in. It merely provides a transport.

The browser then requests the device location (or requests a wipe) through this secure channel.

The result? As seen in firebug below, the data sent through the server is completely opaque.

This is how device finding should be done. You can not trust that a service will never be compromised. You can never trust that a service will not be subject to the will of a government request.

You can only trust that your data was secure from the service itself.

The code is up on github, and a review from outside parties is highly encouraged.
Add a comment...

Alessio Moscatello

Shared publicly  - 
Add a comment...

Alessio Moscatello

Shared publicly  - 
Alessio Moscatello's profile photoIlario Pittau's profile photo
Parlo comunque del mio portatile :P Dovremmo fare un po' di prove incrociate per avere dati oggettivi :P
 ·  Translate
Add a comment...

Alessio Moscatello

Shared publicly  - 
Perfectly fact I've disabled as more as possible annoying application that continuously sends  notification on my Android phone...
Add a comment...
Have him in circles
61 people
  • Polytechnic University of Turin
    Ingegneria Informatica, 2007
Basic Information
  • Magneti-Marelli
    2012 - present
  • Akhela
    2011 - 2012
Map of the places this user has livedMap of the places this user has livedMap of the places this user has lived
Other profiles