Re: [guardian-dev] Crypto export regulations for apps on Google Play

2014-10-22 Thread Mark Murphy
On Wed, Oct 22, 2014, at 19:31, Hans-Christoph Steiner wrote: There is a page on guardianproject.info somewhere that we email to the US Gov. You presumably mean: https://guardianproject.info/home/export-information/ -- Mark Murphy (a Commons Guy) http://commonsware.com | http://github.com

[guardian-dev] NetCipher: How Do I Know That It Is Working?

2016-02-13 Thread Mark Murphy
enabling "Debug Log" in Orbot, but I do not know if it logs request information (or what that might look like), and I do not know if anything is needed beyond checking the checkbox (e.g., restart Orbot, reboot device). Thanks! -- Mark Murphy (a Commons Guy) https://commonsware.c

[guardian-dev] NetCipher Book Chapter, and HTTP Stack Integration

2016-02-24 Thread Mark Murphy
ation code is all Apache License 2.0; you are welcome to any of that if you want it. I welcome any feedback on the prose or the code! -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/

Re: [guardian-dev] NetCipher Book Chapter, and HTTP Stack Integration

2016-02-25 Thread Mark Murphy
it could be a new chunk of work related to this. If you mean https://github.com/moxie0/AndroidPinning, that's GPLv3. Thanks! -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy

Re: [guardian-dev] NetCipher Book Chapter, and HTTP Stack Integration

2016-02-26 Thread Mark Murphy
ay be the source of the difficulty. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To un

Re: [guardian-dev] NetCipher: How Do I Know That It Is Working?

2016-02-14 Thread Mark Murphy
On Sun, Feb 14, 2016, at 01:21, grarpamp wrote: > https://check.torproject.org/api/ip > But that's only for browsers. I'd argue it's for Web service clients as well, which happens to be my test case. A JSON return payload is very cool, and it seems to be working. Many thanks! -- Mark

Re: [guardian-dev] NetCipher Tests

2016-03-29 Thread Mark Murphy
On Tue, Mar 29, 2016, at 12:50, Hans-Christoph Steiner wrote: > If option #2 or #3 custom build.gradle is easy to do, I think that's the > best way for right now since its the lowest impact. OK. Unless you have a strong preference for option #3, I'll start with option #2. Thanks! --

Re: [guardian-dev] NetCipher Book Chapter, and HTTP Stack Integration

2016-03-25 Thread Mark Murphy
flies. https://xkcd.com/378/ Thanks! -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/listinfo/guardi

Re: [guardian-dev] SNI with NetCipher's HttpsURLConnection

2016-03-19 Thread Mark Murphy
ing its base class. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To unsubs

Re: [guardian-dev] SNI with NetCipher's HttpsURLConnection

2016-03-03 Thread Mark Murphy
thout NetCipher. Their fix (https://wiki.apache.org/HttpComponents/SNISupport) is akin to yours. I really dislike using reflection hacks for workarounds, but I'm guessing that there aren't other options here. Thanks for pointing this out! -- Mark Murphy (a Commons Guy) https://commonsware.com | htt

Re: [guardian-dev] where to buy an Android device without Google Play on it?

2016-04-04 Thread Mark Murphy
gt; Has anyone bought Android devices that come without Google Play > installed? There is always the Amazon Kindle Fire series. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy _

Re: [guardian-dev] NetCipher Book Chapter, and HTTP Stack Integration

2016-03-28 Thread Mark Murphy
guely remember seeing such > warnings in logcat. You have *far* greater faith in software developers than I do. > I'm saying remove the keystore references from your code entirely, for > now at least. OK, will do. With luck, I will submit pull requests later this week. -- Mark Murphy (a Common

Re: [guardian-dev] netcipher integrated pinning idea

2016-03-28 Thread Mark Murphy
portant, if we can pull it off. Backwards compatibility is A Very Good Thing for adoption, and while Google might offer their own backport of this stuff, my guess is that they will not. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog |

Re: [guardian-dev] "Enable SNI" pull request CI build is now failing

2016-04-25 Thread Mark Murphy
equest itself caused test result changes on the CI server. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mail

[guardian-dev] NetCipher: WeakSet Alternatives

2016-04-25 Thread Mark Murphy
would have had this method from API Level 1. Thoughts? -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailma

Re: [guardian-dev] NetCipher: Integrate Tor Status Check?

2016-05-13 Thread Mark Murphy
on addresses would not need any > https://check.torproject.org/api/ip checks since they only work through > Tor. OrbotHelper won't know that URL at the time it is doing the confirmation, though, so it needs to confirm regardless of what URLs might get used by the app. -- Mark Murp

[guardian-dev] FYI: Android N Network Security Configuration Code

2016-04-16 Thread Mark Murphy
functionality is not out of the question, which should be easier than a cleanroom implementation from the specification. Anyway, just an FYI, in case anyone's been pondering this stuff... -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https

Re: [guardian-dev] NetCipher v2 alpha: supports OkHTTP, Volley, HttpClient and more

2016-08-14 Thread Mark Murphy
run into the same problem with 'info.guardianproject.netcipher-okhttp3:netcipher:2.0.0-alpha1'. Are you sure that these artifacts have been published? -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twit

[guardian-dev] CWAC-NetSecurity: Android 7.0 Network Security Configuration Backport

2016-07-12 Thread Mark Murphy
client APIs. It works back to API Level 17 (Android 4.2). -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman

Re: [guardian-dev] CWAC-NetSecurity: Android 7.0 Network Security Configuration Backport

2016-07-21 Thread Mark Murphy
handled purely by TrustManagerBuilder, not the backport. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/li

Re: [guardian-dev] help with netcipher

2017-01-22 Thread Mark Murphy
. If onEnabled() is called, that means that we received a STATUS_ON response from Orbot, which should mean that Orbot is accepting requests. Can you reproduce the problem with the sample apps (e.g., sample-okhttp3) or the test suite (in netcipher-okhttp3)? If so, what version of Android and Orbot are you

Re: [guardian-dev] help with netcipher

2017-01-22 Thread Mark Murphy
before giving up and raising a Notification to the user about the problem). -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info:

Re: [guardian-dev] help with netcipher

2017-01-21 Thread Mark Murphy
On Sat, Jan 21, 2017, at 15:49, arrase wrote: > And then is called: > > public void onConnectionException(Exception e) What does the stack trace associated with the exception tell you? -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commons

Re: [guardian-dev] help with netcipher

2017-01-24 Thread Mark Murphy
fusion. Also, thanks for the clarification! -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/listinfo

Re: [guardian-dev] supporting SOCKS on Android via a custom SocketFactory

2016-09-06 Thread Mark Murphy
315 -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-dev To unsubscribe, email: guard

Re: [guardian-dev] test when proxying WebView

2016-09-28 Thread Mark Murphy
ebView: http://stackoverflow.com/questions/19518950/get-the-html-code-from-loaded-webview -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info:

Re: [guardian-dev] Hi, i' new

2016-11-22 Thread Mark Murphy
Failed to parse > com.commonsware.cwac.provider.STREAM_PROVIDER_PATHS meta-data You did not replace android:name with the fully-qualified class name of your StreamProvider subclass. StreamProvider does not know about your custom tag. For further help with StreamProvider, please use: https://github.com/commonsguy/cwac-provider#question

Re: [guardian-dev] NetCipher interface for anonymity configurations

2016-11-13 Thread Mark Murphy
ers would configure this other stuff and skip setting up the Tor proxy hooks. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists

Re: [guardian-dev] Fwd: [Android eng] FYI Android Studio 3.0 may inject profiler files into APK

2017-12-01 Thread Mark Murphy
m/android/tools/profiler/support but that is two years old and is missing stuff that I see in the decompiled JAR. I filed an issue to try to get them to offer an option to disable this functionality: https://issuetracker.google.com/issues/70019396 -- Mark Murphy (a Commons Guy) https://commonsw

[guardian-dev] FYI: Facebook "Secure the Internet" Grant Program

2018-01-23 Thread Mark Murphy
ernet users. Our goal is to spur development of technology that may be applied in practice, rather than pure research..." I wonder a bit about how unrestricted the "unrestricted gift" is, but this program might be of interest to established non-profits in this space. -- Mark M

Re: [guardian-dev] Android locking down private APIs

2018-04-06 Thread Mark Murphy
Security by obscurity, I guess. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org/mailman/listinfo/guardian-d

Re: [guardian-dev] Orbot 16.0.5-RC-2-tor-0.3.4.9

2018-12-14 Thread Mark Murphy
, or at all, every time your service is > launched with startForegroundService() then you get a crash, on some > indeterminate set of "strict" devices. FWIW, that crash should occur on all Android 8.0+ devices. -- Mark Murphy (a Commons Guy) https://commonsware.com | h

[guardian-dev] Seeking Jetpack Compose Security Concerns

2019-11-03 Thread Mark Murphy
them fixed. Thanks in advance for any suggestions or support! -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.org

Re: [guardian-dev] Seeking Jetpack Compose Security Concerns

2019-11-04 Thread Mark Murphy
implementation, etc.). The bigger thing is that Google will be steering developers to use it, which means the next generation of Android developers will start with Compose. So, while Compose is still nicely malleable, we need to try to make sure that it doesn't screw up security. -- Mark Murphy (a Com

Re: [guardian-dev] Manipulating App Bundles

2020-06-21 Thread Mark Murphy
te: I mention F-Droid, as their policy had been to sign apps with their own signing key. It looks like now that there are some options for avoiding this, but I felt the need to address this head on. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commons

Re: [guardian-dev] Manipulating App Bundles

2020-06-22 Thread Mark Murphy
looking. Perhaps people are looking and I just don't know about it -- if you know of people who are, I'd love to hear about them! That being said, I replaced the section where I mentioned F-Droid with another one where I don't mention them directly. A revised post is attached. Thanks for the f

[guardian-dev] FYI: Code Transparency

2021-06-29 Thread Mark Murphy
nsware.com/blog/2021/06/29/initial-thoughts-code-transparency.html -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/blog | https://twitter.com/commonsguy ___ List info: https://lists.mayfirst.o

Re: [guardian-dev] FYI: Code Transparency

2021-06-30 Thread Mark Murphy
library that you propose will almost "fall out of" work to create a library for checking the integrity of other apps. Having it probably won't hurt. -- Mark Murphy (a Commons Guy) https://commonsware.com | https://github.com/commonsguy https://commonsware.com/bl

Re: [guardian-dev] Android App Bundles

2021-04-29 Thread Mark Murphy
e developer relations members on the topic. However, after that late November post, I have not seen much on this subject coming out of Mountain View. I suspect that I'll be writing another post, perhaps tomorrow, pointing out Google I|O sessions that might be of relevance on this subject. -- Mark