Aung Kyaw Paing

Android @GoogleDevExpert | Senior Consultant/Mobile Engineer @thoughtworks | CoHost @techshawcast | He/Him

[Aung Kyaw Paing @vincentpaing]

@cyberMilosz @YaroST12 @vxunderground Actually all frontend reliant encryption are not safe and best option is not to store high risk data on frontend. Frontend security is a security flaw!

[Aung Kyaw Paing @vincentpaing]

@cyberMilosz @YaroST12 @vxunderground Encrypted Shared Preference is not safe. If an attacker got root and physical access, it can just easily be exploited. That's why Google killed the library

[Aung Kyaw Paing @vincentpaing]

@Paul_Reviews @vxunderground That's why Tink, Google's crypto library, specifically mentioned in the docs that it's okay to save *frontend* cryptographic keys like PINs in plaintext because it is extremely hard to access an app's internal data while bypassing anti tempering checks

[Aung Kyaw Paing @vincentpaing]

@Paul_Reviews @vxunderground The problem is it can only be done with physical possession of the phone which is an extremely low attack vector that it's negligible. What encryption do you recommend anyways? If a hacker got root and physical access, no frontend encryption is safe.

[Aung Kyaw Paing @vincentpaing]

@acoolrocket @Paul_Reviews Tbf no root detection is fully reliable but OP conveniently didn't mention that normal users don't root their device, and that this is very low chance to be exploited considering an attacker would need physical access to root the device

[Aung Kyaw Paing @vincentpaing]

@Paul_Reviews And for a non rooted device, unlocking boot loader automatically wipe out all the data. And even if that is bypassed and an attacker got physical access to an untempered phone, you'd be more concerned about banking apps

[Aung Kyaw Paing @vincentpaing]

@Paul_Reviews I don't support government surveillance but you're not disclosing that it is impossible for another app to modify an app's internal data like shared preference unless the device has root access. For attacker to realistically exploit this attack, they'd need physical access

[Aung Kyaw Paing @vincentpaing]

@skankshunts @DynamoSuperX @KiloSparx @RivalsAssembled

[Aung Kyaw Paing @vincentpaing]

@chhopsky @drewlevin @Drututt Not being able to play a game is not as serious impact as a security vulnerability. Bugs like this are reported in open forums likes GitHub all the time

[Aung Kyaw Paing @vincentpaing]

@pickle_ai Is this also cloned from open source repo and pretended like you made it?

[Aung Kyaw Paing @vincentpaing]

@PeculiarShroom @PirateSoftware I'm a software dev. His perspective is just wrong.

[Aung Kyaw Paing @vincentpaing]

@PirateSoftware @offbrand_games @CommunityNotes can we add this context that there was no review bombing. Data from steam

[Aung Kyaw Paing @vincentpaing]

@ESLDota2 @valvesoftware Graphic design is my passion ah merchs

[Aung Kyaw Paing @vincentpaing]

@adbracadadra @bloomthisway Is it true that they are using dynamic pricing for the seats?

[Aung Kyaw Paing @vincentpaing]

@TD_Mani "I hate when a rapper talk about guns, then somebody die They turn into nuns, then hop online, like "pray for my city" He fakin' for likes and digital hugs"

[Aung Kyaw Paing @vincentpaing]

@BARDIVERSACE @chartdata @kendricklamar Is Taylor a male?

[Aung Kyaw Paing @vincentpaing]

@PotatoSec @whoismrrobot @1o57 @defcon https://t.co/2XPrl4vprX

The original artist is cool with it, why are you so mad

[LostboY 1057 @1o57]

@defcon @thedarktangent I'm flattered, and I really enjoy the show. It's ok guys, no need to attack @KorAdana he is doing a great job.

[Aung Kyaw Paing @vincentpaing]

@skillfulpoett @burna_boss1 @mosthiphop They're illiterate bro

[Aung Kyaw Paing @vincentpaing]

@hiphopunison Just say you like supporting a known pedophile, lil bro

[Aung Kyaw Paing @vincentpaing]

@JahTalksMusic There's no introspection without accountability. The whole song is X did Y to me, never I did X that led to Y.