Brazilian government app (gov.br)

akaSorin

DeletedUser759 I think the analysis and pathways given by @lbschenkel are a really nice way to try and explore solutions.

Knowing what the main issue was, also helps us think about non-google ways to solve that issue with mTLS, certificate pinning, etc... Banks found ways to secure their products, if we explore those solutions deeper we might be able to provide (at least at the theoretical level) nice alternatives for SERPRO and other apps that are also on the same path of depending on Google.

We can keep the good work of analysis and coming up with solution even though we don't expect adoption to happen.

eduardo_costa

Another fellow brazilian slave here, living on a pixel. Just filed a complaint but this only serves to feel I am doing something.
I think we are seeing the problem the wrong way. Crappy gov app will not go away, and will not facilitate our access.
The real question is:
What is the worst kind of hardware we can run gov.br on? can we plug it to a server and access it anywhere? can we send mock location data and metadata to add garbage to their data collection?
The point is: how come an old android phone can meet strong attestation and also be exploited in a dozen different ways to our disadvantage, not ALSO be exploited to our advantage?

lbschenkel

eduardo_costa You cannot do any of that. App will only work on devices passing Play Integrity (therefore stock and not rooted) plus it will refuse to run if developer options are enabled, so you cannot capture screen, control it or inject mock location data.

eduardo_costa

lbschenkel Maybe I can do an android KVM, so I will be the screen, and not someone capturing it

lbschenkel

eduardo_costa It won't pass Play Integrity, the app will refuse to run.

eduardo_costa

I may be wrong, but I am also not smart.
I have the things. I will try.

eduardo_costa

test: gov.br on a samsung note10+, connected to a normal monitor with an HDMI dongle. I am able to open the app and show the 2FA token on the monitor, using DEX. Looks promising.
I will try teamviewer or anydesk to remote control the phone. If it fails, I will use an HDMI capture USB dongle with a PiKVM.
Objective: unlock the gov.br 2FA functionality, allowing me to access gov services on different PCs, without carrying a second phone other than my pixel with grapheneOS.
I can also confirm that the BirdID app works on grapheneOS, so I can use my pixel to authenticate on websites that require a brazilian digital certificate of identity (cloud-stored certificate).

Totally unrelated note: It seems that the BR government suffered yet another leak of personal information of citizens.

eduardo_costa

eduardo_costa Anydesk works and I can see the 2fa on a remote phone. Caveat: every biometric event is a blank screen on the remote, and disabling biometrics on gov.br requires cold login using a digital certificate, or user/passwd, with different privilege tiers (feasible, not recurring until the app restarts, but anoying). I will try changing phone auth to pattern or pin.

« Previous Page