Top all-time · #15807
Yiannis Kozyrakis
Personal blog · koz.iosecurityprogramming
Yiannis Kozyrakis's personal blog at koz.io covers security and programming. Since 2015, 5 different Hacker News readers have linked it 5 times, most often “SafetyNet: Google's tamper detection”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for posts on Android's SafetyNet attestation API and on reverse engineering apps, including using Frida on Android without root. Commenters cite these posts as sources.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
thoughts on mobile security
Most-linked posts?
- SafetyNet: Google's tamper detection4 people · 4 mentions · first linked 2015-09-20
What Hacker News says?
What about the right to use our electronics? Google has been silently pushing their "SafetyNet" APIs into Android, including an "attestation" API[1] that dynamically fetches and runs an opaque binary program[2] served and signed by Google that collects whatever data they deem necessary to verify the "integrity" of a device. Devices that are rooted will not fail to attest via the API. Devices where the user has chose…
Comment linking /inside-safetynet/
on “Why We Must Fight for the Right to Repair Our Electronics”Submitted SafetyNet: Google's tamper detection as a story · 2 points
HN discussion> Google devices are probably some of the most allowing of root access and full device ownership Did you hear about SafetyNet? https://koz.io/inside-safetynet/
Comment linking /inside-safetynet/
on “Pi-hole – A black hole for Internet advertisements”SafetyNet is pretty flexible. It actually isn't implemented inside any APK - "The SafetyNet service reaches out to a Google server and downloads a binary package with the code. It goes to great lengths to validate the integrity of the package, for example using hardcoded certificates (pinning). This binary package is essentially a JAR file that contains a classes.dex file with java bytecode. Play Services caches it…
Comment linking /inside-safetynet/
on “Introducing Netflix Stethoscope”You can actually get by without root by using Frida ( https://frida.re/docs/android/ ), at least on Android. By repackaging the APK to include frida-gadget (such as in this tutorial: https://koz.io/using-frida-on-android-without-root/ ), you can get all of Frida's capabilities on that app without root. That said, it is more convenient to have a spare rooted phone.
Comment linking /using-frida-on-android-without-root/
on “So I reverse engineered two dating apps”