| Pages: [1] :: one page |
| Author |
Thread Statistics | Show CCP posts - 0 post(s) |
Johnny Bloomington
Justified Chaos
26
   |
Posted - 2012.10.20 00:50:00 -
[1] - Quote
API Migration to HTTPS has broke Aura for older Android phones.
From the dev of Aura app:
"CCP Games decided to get a SSL certificate from Certificate Authority (CA) that isn't well known. What this means is that anyone with a older version of Android (I believe <3.0) will not be able to connect to the new API. Next week I will have a fix out that just accepts the SSL connection regardless of who is on the other side (are you ready for some man-in-the-middle-attacks?).
Why didn't this fail before? I had code in there before to gracefully fall back to a http connection if the https connection didn't work. As it turns out it was always using the http code path so the https one was never tested. Even though it is taking the http code path, it is properly redirecting to https and this is why newer devices that have the cert installed on them are working.
Why does Chrome work and not Android? Chrome, from what I can tell, is not using the system SSL certs and that is why it is working. Unfortunately there is no way for users to install custom SSL CA's.
What can I do to help? Protest, threaten to quit, laugh and make fun of CCP for thinking they are a "tech" company." |
Cyerus
Galactic Dominion
Eternal Strife
57
|
Posted - 2012.10.20 02:26:00 -
[2] - Quote
Johnny Bloomington wrote:API Migration to HTTPS has broke Aura for older Android phones.
From the dev of Aura app:
"CCP Games decided to get a SSL certificate from Certificate Authority (CA) that isn't well known. What this means is that anyone with a older version of Android (I believe <3.0) will not be able to connect to the new API. Next week I will have a fix out that just accepts the SSL connection regardless of who is on the other side (are you ready for some man-in-the-middle-attacks?).
Why didn't this fail before? I had code in there before to gracefully fall back to a http connection if the https connection didn't work. As it turns out it was always using the http code path so the https one was never tested. Even though it is taking the http code path, it is properly redirecting to https and this is why newer devices that have the cert installed on them are working.
Why does Chrome work and not Android? Chrome, from what I can tell, is not using the system SSL certs and that is why it is working. Unfortunately there is no way for users to install custom SSL CA's.
What can I do to help? "
Simplest thing to do is find a way to include the needed certificate yourself.
On the mod for phpBB I've been coding for the last years, I had somewhat similar problems.
I'm using cURL (as a PHP extension) which requires a valid certificate to gather data over SSL connections.
Some providers seem not to have installed them, or at least not correctly.
After a few hours of searching, I managed to find a workaround which allows me to use the certificate I'm supplying with the package, after having it extracted from Firefox.
I'm not sure why you would be saying that Android doesn't allow the installation of CA certificates, since the first hit on Google when searching for Android install CA certificate redirects me towards the official Android support wiki, explaining in detail on how to manually install any certificate.
http://support.google.com/android/bin/answer.py?hl=en&answer=1649774
Question is whether or not that can be automated using Aura's installer. |
Vaknar Onzo
Concordiat
Tribal Band
2
|
Posted - 2012.10.20 11:23:00 -
[3] - Quote
It isn't just Aura, it's any Android app that uses API. |
Johnny Bloomington
Justified Chaos
26
|
Posted - 2012.10.20 16:56:00 -
[4] - Quote
Vaknar Onzo wrote:It isn't just Aura, it's any Android app that uses API.
But its just older phones. |
Marcel Devereux
Aideron Robotics
167
|
Posted - 2012.10.20 17:57:00 -
[5] - Quote
Johnny Bloomington wrote:Vaknar Onzo wrote:It isn't just Aura, it's any Android app that uses API. But its just older phones.
I also don't think it is appropriate for each app on the platform to maintain a local copy of the cert. If for any reason CCP changes the cert then the app will break. The correct solution is for them to use a well know CA. I am testing the fix right now that just ignores the cert. Every other Android app should just do the same. |
Cyerus
Galactic Dominion
Eternal Strife
58
|
Posted - 2012.10.20 18:33:00 -
[6] - Quote
Marcel Devereux wrote:Johnny Bloomington wrote:Vaknar Onzo wrote:It isn't just Aura, it's any Android app that uses API. But its just older phones. I also don't think it is appropriate for each app on the platform to maintain a local copy of the cert. If for any reason CCP changes the cert then the app will break. The correct solution is for them to use a well know CA. I am testing the fix right now that just ignores the cert. Every other Android app should just do the same.
Sorry to say, but ignoring any certificates is just stupid. Specially on phones (and some tablets), where most internet connections are being made with 3g (except for WiFi when at home/work), and as we all know those providers are now using DPI (http://en.wikipedia.org/wiki/Deep_packet_inspection).
Now that we (as devs) are forced to use SSL, we might aswell implement it correctly, with verification.
And CCP will not change the certificate per se, since they rent the certificate from RapidSSL, whom in turns rents a license for being a CA from GeoTrust. The only thing they can change is the CA vendor, and that will only require importing another certificate into the user's old Android phone.
Another thing that should be noted is that every program can use any certificate that's installed on Android, meaning that you only have to install the certificate once for all programs to use. |
Novacrow
Tzintch Mining Corporation
0
|
Posted - 2012.10.22 01:52:00 -
[7] - Quote
This sucks. Any idea when a fix will be inc? |
Slaingeal
ROFLSTOMPERS
Gank for Profit
0
|
Posted - 2012.10.22 07:54:00 -
[8] - Quote
love to see a fix, your app is pritty much indispensable... keep it up |
Manhim
Cyan Ventures
Ironworks Coalition
2
|
Posted - 2012.10.22 13:25:00 -
[9] - Quote
Quote:(are you ready for some man-in-the-middle-attacks?)
Is using plain HTTP man-in-the-middle attacks proof? |
Cyerus
Galactic Dominion
Eternal Strife
58
|
Posted - 2012.10.22 13:41:00 -
[10] - Quote
Manhim wrote:Quote:(are you ready for some man-in-the-middle-attacks?) Is using plain HTTP man-in-the-middle attacks proof?
No it isn't, but SSL is.
Since we are forced to use SSL and implementation of certificates (with verification!!) is easy and fast to do, why not make use of it? |
Johnny Bloomington
Justified Chaos
27
|
Posted - 2012.10.22 18:07:00 -
[11] - Quote
Cyerus wrote:Manhim wrote:Quote:(are you ready for some man-in-the-middle-attacks?) Is using plain HTTP man-in-the-middle attacks proof? No it isn't, but SSL is. Since we are forced to use SSL and implementation of certificates (with verification!!) is easy and fast to do, why not make use of it?
The other app like this called Evanova is working for me now. Does this mean they're using just HTTP? I'd rather have Aura but Evanova is working for me now. |
| |
|
| Pages: [1] :: one page |
| First page | Previous page | Next page | Last page |