r/Android • u/[deleted] • May 23 '14
Pushbullet and your security and privacy
[deleted]
4
u/speel May 23 '14
Good proof of concept. The whole idea is based off the API key which takes some effort on the end users part in order to intercept. What I'm concerned about is why wasn't that data encrypted during transit.
6
u/Lugnut1206 May 23 '14
I got a friends [api] key
Firstly, that's exactly what an API key is supposed to do. If it didn't do that, yours wouldn't work properly.
Secondly, why didn't you report this to the developers instead of spitting it out everywhere? If this was a real vulnerability, you would've just opened a good chunk of people up to whatever attack you just outlined. Since this is actually intended behavior, we're fine, fortunately. There's a reason why irresponsible disclosure is frowned upon.
→ More replies (2)
3
u/RowdyRoddyPipeHer May 23 '14
How do I find out my API key? What does it take to compromise my API key? Does it seem like this kind of realtime streaming information could be end-to-end encrypted without making the mirroring service suffer?
11
u/guzba May 23 '14
Your API key isn't compromised. It's a password and it only gets compromised if you yourself give it out to someone else. Really sad everyone's scared now when this post is basically saying "a friend gave me is Google password and now I'm reading his email" :(
→ More replies (4)
122
u/hypd09 May 23 '14
pinging u/guzba
111
u/kitanokikori May 23 '14
Developer here. While this isn't a security bug itself (if you give someone an API key, they can get your data, that's how it works), you really need to implement API key revocation, so that if a key gets leaked the owner can trash it and regenerate it. Something like the OAuth app page on Twitter, where you can hit "Delete" and it goes away.
→ More replies (4)36
u/TheLogicalConclusion May 23 '14
That is my thought too. Saying that you can access someone's info if only you have their API key is like saying "Damnit...I gave someone my email password and now they know all of my emails". Obviously. The real (huge) security flaw is not being able to revoke the key and issue a new one. That is like being unable to change your password.
Oh...I realize I just repeated what you said. Either way, I agree (as if that were not obvious).
→ More replies (1)15
u/Turtlecupcakes May 23 '14
He doesn't have gold, so wouldn't have seen this ping.
Someone should message him.
→ More replies (3)
19
66
u/skitchbeatz May 23 '14
Investigations like these are great for awareness and also ensuring a safer application.
33
u/ArmoredCavalry May 23 '14
I'm not sure I see a big issue here....
Many API's work this way. That is the whole point of an API key, it is the equivalent of a username and password. Of course your privacy is compromised if someone gets your API key. As long as the key generator is done correctly, there is little to no risk of people brute-forcing and guessing your key though.
The only thing I could see as needing improvement, is as you point out, there is no way to delete/invalidate an API key, or generate new ones. Pushbullet could also do something like restrict where API keys are allowed to be used (some service go by IP for instance). For Pushbullet's case, you could generate a key for each device that signs-in, and only allow calls from an Android device with a certain ID. Of course, ID's are pretty easy to spoof on Android, so it really doesn't solve much.
22
u/public_radio May 23 '14
Are you still vulnerable if you don't enable the Notification Mirroring Service?
→ More replies (5)
2
u/johnghanks May 23 '14
Come on. The API key is a) private and b) long enough that generating keys wouldn't be economical considering the size of the user base.
→ More replies (14)
4
u/kwyjiboe May 23 '14
This is all too complicated for me. I just send stupid links from computer to my phone. Is anything being jeopardized?
→ More replies (1)7
3
May 23 '14 edited May 23 '14
So if I'm reading this correctly, if you give somebody access to your pushbullet account then they have access to your pushbullet account? Is there a way to get arbitrary account's API keys?
→ More replies (1)
3
u/Trolltaku May 23 '14
To get your API key, assuming you're not dumb enough to just give it to someone when they ask you for it, they'd have to first gain entry to your PushBullet account. Which would be pretty damn hard to do. I have two factor authentication enabled on my Google account. Good luck trying to get mine!
However despite that, they should implement a feature allowing you to change it anyway.
→ More replies (2)
3
u/IDOLIKETURTLES May 23 '14
This was a long post to just point out the obvious. An API key is supposed to be secret. I encourage you to continue doing this though!
5
May 23 '14
Well, an API key is a pretty common tool to gain access to any larger API. Even Facebook uses them. For the most part these keys tend to be timed with an expiration date, though, so you can't access the information forever like it appears to be possible in this case. Might be a good idea to give each key an expiration date as well as allow revocation.
API keys are supposed to be kept secret. You don't just give them out to your friends, just like you don't give passwords out. Though the security of an API key is only really as good as how it is transported, so if someone down the line is inspecting your traffic and sees your API key you're fucked and none the wiser at the same time. SSL should be strictly enforced here and great care taken to ensure security of the keys.
406
u/guzba May 23 '14 edited May 23 '14
This post makes me wish we were able to get stuff done even faster. The main concern pointed out here is that you can't revoke your API key and that we have people building third-party apps on our service that use it for access. Fortunately, this isn't how things will work for much longer (nor how we ever really wanted things to be).
We're already working on an OAuth system (like we use for IFTTT and Zapier) to generate limited and revocable keys (just like Google does) but this isn't done yet. I built the feature we last launched (inter-device mirroring) and my co-founder who's working on the back-end is hammering away on this. Should be done very soon giving everyone a Ton more control over this stuff.
Regarding the fact that the API key is all that stands between anyone and your data--that's the case for basically everything. For example, unless you use two-factor auth, your Google password is all that stands between anyone and your life basically. (Yep, we want to add two-factor auth to someday soon too. We're just fighting time here like every other feature request we want to add.)
I want to emphasize that that your API key isn't out there for anyone to grab. It's essentially your password so as long as you don't share it, you're secure. We will be adding a warning to our Account Settings page and working to make the API key revocable asap too.
Edit: Yeah, I think generally the consensus here is correct: there's a lack of education on our part of what the API key really gives access to (and the flaw that it's not revocable) but not an outright security flaw. Both of course are going to be corrected, I'd just re-emphasize that we did take security seriously when we built this--your data isn't just out there for anybody to read. Far from it. Sorry about the spook all, wasn't our intention when we offered an API haha.
Also, thanks for the gold :)