{"id":35532,"date":"2019-10-31T22:04:52","date_gmt":"2019-10-31T19:04:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/bezopasnye-push-uvedomleniya-ot-teorii-k-praktike\/"},"modified":"2019-10-31T22:04:52","modified_gmt":"2019-10-31T19:04:52","slug":"bezopasnye-push-uvedomleniya-ot-teorii-k-praktike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnye-push-uvedomleniya-ot-teorii-k-praktike","title":{"rendered":"Njoftimet push t\u00eb sigurta: nga teoria n\u00eb praktik\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrsh\u00ebndetje, Habr! <\/p>\n

Sot do flas p\u00ebr at\u00eb q\u00eb un\u00eb dhe koleg\u00ebt e mi po punojm\u00eb prej disa muajsh: njoftimet push p\u00ebr aplikacionet mobile t\u00eb mesazheve. Si\u00e7 kam th\u00ebn\u00eb, n\u00eb aplikacionin ton\u00eb r\u00ebnd\u00ebsia kryesore \u00ebsht\u00eb siguria. Prandaj, ne kemi hetuar n\u00ebse njoftimet push kan\u00eb \"pik\u00eb t\u00eb dob\u00ebt\" dhe, n\u00ebse po, si mund t'i neutralizojm\u00eb ato p\u00ebr t\u00eb shtuar k\u00ebt\u00eb opsion t\u00eb dobish\u00ebm n\u00eb sh\u00ebrbimin ton\u00eb.<\/p>\n

Po publikoj p\u00ebrkthimin e artikullit ton\u00eb nga Medium<\/a><\/noindex> me disa shtesa nga ana ime. N\u00eb t\u00eb, ka p\u00ebrmbledhje t\u00eb \"hetimit\" dhe nj\u00eb tregim se si u zgjidh problemi.<\/p>\n

Po studiojm\u00eb materialin<\/h2>\n

\nN\u00eb modelin klasik, njoftimet push e b\u00ebjn\u00eb aplikacionin t\u00eb cenuesh\u00ebm ndaj sulmeve MITM (Man-in-the-middle, 'Njeriu n\u00eb mes'). P\u00ebr shembull, te Google, Microsoft dhe n\u00eb versionin e vjet\u00ebr t\u00eb iMessage, aplikacioni d\u00ebrgon \u00e7el\u00ebsat e enkriptimit n\u00eb server\u00ebt e Apple - autentifikimi i p\u00ebrdoruesve dhe dekriptimi i titullit t\u00eb mesazhit (ose i p\u00ebrmbajtjes) ndodhin n\u00eb server.<\/p>\n

\"Njoftimet
\n
\nSi rezultat, ekziston mund\u00ebsia p\u00ebr t\u00eb lexuar bisedat, duke fituar akses n\u00eb serverin e njoftimeve push. Kjo do t\u00eb thot\u00eb se \u00e7do enkriptim i bisedave \u00ebsht\u00eb i kota: njoftimet push megjithat\u00eb do t\u00eb l\u00ebn\u00eb mund\u00ebsi p\u00ebr t\u00eb lexuar nga pal\u00eb t\u00eb treta. Kjo mund\u00ebsi \u00ebsht\u00eb diskutuar m\u00eb shum\u00eb nga autor\u00ebt e artikullit \"Enkripto me men\u00e7uri\"<\/a><\/noindex> n\u00eb Xaker.ru, i dedikuar m\u00ebnyrave t\u00eb enkriptimit t\u00eb mesazheve. <\/p>\n

N\u00ebse ju duket se server\u00ebt e Apple dhe Google 100% nuk do t\u00eb lejojn\u00eb rrjedhjen e \u00e7el\u00ebsave t\u00eb enkriptimit t\u00eb p\u00ebrdoruesve, mendoni p\u00ebr faktin se punonj\u00ebsit e tyre kan\u00eb akses n\u00eb k\u00ebto server\u00eb. Dhe punonj\u00ebsit jan\u00eb njer\u00ebz.
\nPavar\u00ebsisht t\u00eb gjitha vulnerabiliteteve t\u00eb njoftimeve push, shum\u00eb aplikacione t\u00eb \"sigurta\", p\u00ebrfshir\u00eb Signal dhe Telegram, i p\u00ebrdorin ato. N\u00eb t\u00eb kund\u00ebrt, p\u00ebrdoruesit do t\u00eb duhet ta monitorojn\u00eb \"me dor\u00eb\" mesazhet e reja, duke hyr\u00eb vazhdimisht n\u00eb aplikacion. Kjo \u00ebsht\u00eb jasht\u00ebzakonisht e pap\u00ebrshtatshme, dhe konkurent\u00ebt do t\u00eb fitojn\u00eb avantazh.<\/p>\n

Paranoja dhe sh\u00ebndeti i mir\u00eb<\/h2>\n

<\/a><\/noindex>
\nN\u00eb projektin ton\u00eb, ne kemi filluar k\u00ebt\u00eb \u00e7\u00ebshtje me ngulm disa muaj m\u00eb par\u00eb. Na duhej t\u00eb krijonim opsionin e njoftimeve push p\u00ebr t\u00eb qen\u00eb konkurrues. Por n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, nuk duhej t\u00eb krijonim nj\u00eb dob\u00ebsi n\u00eb siguri, sepse \u00e7do rrjedhje t\u00eb dh\u00ebnash do t\u00eb minonte besimin n\u00eb projekt.<\/p>\n

Megjithat\u00eb, ne kemi nj\u00eb avantazh t\u00eb r\u00ebnd\u00ebsish\u00ebm: mesazher\u00ebt tan\u00eb jan\u00eb t\u00eb decentralizuar (t\u00eb dh\u00ebnat ruhen n\u00eb blockchain), nd\u00ebrsa punonj\u00ebsit nuk kan\u00eb akses n\u00eb llogarit\u00eb. \u00c7el\u00ebsat e enkriptimit i kan\u00eb vet\u00ebm p\u00ebrdoruesit, nd\u00ebrsa \u00e7el\u00ebsat publik\u00eb t\u00eb biseduesve jan\u00eb t\u00eb disponuesh\u00ebm n\u00eb blockchain, p\u00ebr t\u00eb mbrojtur nga sulmet MITM.<\/p>\n

N\u00eb versionin e par\u00eb t\u00eb njoftimeve, vendos\u00ebm t\u00eb p\u00ebrshtatemi maksimalisht dhe t\u00eb mos d\u00ebrgojm\u00eb fare tekstin e mesazhit. Sh\u00ebrbimi i njoftimeve merrte nga nodi jo tekstin e mesazhit, por vet\u00ebm sinjalin p\u00ebr faktin e marrjes s\u00eb tij. Prandaj, p\u00ebrdoruesi e shihte njoftimin \"Keni marr\u00eb nj\u00eb mesazh t\u00eb ri\". E lexoni at\u00eb ishte e mundur vet\u00ebm n\u00eb mesazher. <\/p>\n

\"Njoftimet
\nSi funksiononte: video<\/a><\/noindex>.<\/p>\n

Pas k\u00ebsaj, m\u00ebsuam se n\u00eb versionin e fundit t\u00eb njoftimeve nga Apple ka elemente t\u00eb reja mbrojtjeje. Ato publikuar<\/a><\/noindex> UNNotificationServiceExtension, i cili u lejon zhvilluesve t\u00eb d\u00ebrgojn\u00eb t\u00eb dh\u00ebna njoftimi t\u00eb plot\u00eb t\u00eb enkriptuara p\u00ebrmes APNS. Pastaj aplikacioni n\u00eb pajisjen e p\u00ebrdoruesit p\u00ebrfundimtar kryen dekriptimin (ose ngarkon t\u00eb dh\u00ebna shtes\u00eb) dhe shfaq njoftimin. K\u00ebt\u00eb e mor\u00ebm si baz\u00eb p\u00ebr versionin e dyt\u00eb t\u00eb njoftimeve.<\/p>\n

Tani kemi zhvilluar versionin e dyt\u00eb t\u00eb njoftimeve push p\u00ebr iOS, i cili lejon shfaqjen e tekstit t\u00eb mesazhit pa rrezikun e siguris\u00eb. N\u00eb konceptin e ri, logjika duket k\u00ebshtu:<\/p>\n