Snapception
Security and privacy
traffic interception tool
SHOW HN2014
How HN took it
0 positive, 11 neutral or asking, 0 mixed, 12 critical, out of 23 comments about the project. Thread score -0.47.
Privacy: 0 for, 5 againstExecution: 0 for, 3 againstIdea: 0 for, 2 againstDocs: 0 for, 1 againstPerformance: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
Objections
Snapchat's encryption is weak: ECB mode and a single hardcoded key.
From 3 comments
Snapchat use ECB as the cipher mode of operation: https://github.com/thebradbain/snapception/blob/781ebb13cd7ee75cb56c744a94fa3945e764dd7a/snapception/decrypt_snap.rb#L15 To see…
tomfitz on HN> Intercept and decrypt all snapchats received over your network Somewhat misleading in light of: > Anyway, for Snapception to intercept your snapchats, you must be connected to…
elwell on HNlol1 @ using a single key to decrypt everything; lol2 @ not using certificate pinning
snappieT on HN
Tool requires the user to install a proxy CA certificate, limiting reach.
From 3 comments
Connecting via a proxy and installing a CA means this is more of a tool for a snooping parent to intercept the snapchats of their kids while they are at home, rather than a…
primitivesuave on HNNot necessarily. If you control the gateway, it's possible to transparently redirect outbound connections into your proxy. I used to do this back in the 90s to force our…
chrissnell on HNYes, but they would be clued in because the SSL certificate wouldn't be valid unless they trust your CA.
brazzledazzle on HN
Snapchat's security is poor for a company of its valuation.
From 1 comment
Snapchat's supposed valuation at $10b while they appear to be completely inattentive to the security of their product is hard to reconcile.
droopybuns on HN
Tool did not work for some users, with an empty snaps directory or iOS redirect.
From 2 comments
Doesn't seem to work. It's catching traffic but the snaps directory is empty.
exabrial on HNI can't get this to work on my iPhone. When I visit mitm.it from my phone, or any other device, it redirects me to grit.io. How do I install the CA. I have the proxy up and…
ankushio on HN
Questions
How to install the CA certificate on an iPhone.
From 1 comment
I can't get this to work on my iPhone. When I visit mitm.it from my phone, or any other device, it redirects me to grit.io. How do I install the CA. I have the proxy up and…
ankushio on HN
Does it work with the newer Android encryption.
From 2 comments
But snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt You will need the android id of the phone, which I don't think…
enimodas on HNOoh, I didn't even to think to test it on Android phones. This method works on iOS devices, however.
thebradbain on HN
Alternatives named
snapchat-decrypt for Android
From 1 comment
But snapchat updated its encryption just a couple of days ago: https://github.com/programa-stic/snapchat-decrypt You will need the android id of the phone, which I don't think…
enimodas on HN