Profile

Cover photo
Alessio Moscatello
Works at Magneti-Marelli
Attended Polytechnic University of Turin
Lived in Torino
61 followers|9,741 views
AboutPostsPhotosVideos

Stream

Alessio Moscatello

Shared publicly  - 
 
CyanogenMod encrypted Device Finder!!
 
Technical Details on +CyanogenMod Device Finder

The new +CyanogenMod Device Finding service creates a secure connection between your browser (javascript) and your phone.

The server never has your password. Your authentication is a derived password.
A public key is generated in the browser, and hmac'd with the actual password (unavailable to the server).
On a device find request, the Android device receives this public key, and validates it is authentic, as the Android device also has the same, underived/original, password.
The Android device sends back an encrypted symmetric key using the public key.
The server can not decrypt the symmetric key, as it does not have the private key.
The browser receives the encrypted payload, and decrypts the symmetric key.

The browser and phone at this point have a secure communication channel, and both sides have authenticated each other. The server is not capable of listening in. It merely provides a transport.

The browser then requests the device location (or requests a wipe) through this secure channel.

The result? As seen in firebug below, the data sent through the server is completely opaque.

This is how device finding should be done. You can not trust that a service will never be compromised. You can never trust that a service will not be subject to the will of a government request.

You can only trust that your data was secure from the service itself.

The code is up on github, and a review from outside parties is highly encouraged.
1
Add a comment...

Alessio Moscatello

Shared publicly  - 
1
Add a comment...

Alessio Moscatello

Shared publicly  - 
1
Alessio Moscatello's profile photoIlario Pittau's profile photo
8 comments
 
Parlo comunque del mio portatile :P Dovremmo fare un po' di prove incrociate per avere dati oggettivi :P
 ·  Translate
Add a comment...

Alessio Moscatello

Shared publicly  - 
 
Perfectly agree...in fact I've disabled as more as possible annoying application that continuously sends  notification on my Android phone...
1
Add a comment...
People
Have him in circles
61 people
Education
  • Polytechnic University of Turin
    Ingegneria Informatica, 2007
Basic Information
Gender
Male
Work
Employment
  • Magneti-Marelli
    2012 - present
  • Akhela
    2011 - 2012
Places
Map of the places this user has livedMap of the places this user has livedMap of the places this user has lived
Previously
Torino
Links
Other profiles