{"id":35532,"date":"2019-10-31T22:04:52","date_gmt":"2019-10-31T19:04:52","guid":{"rendered":"https:\/\/prohoster.info\/blog\/bezopasnye-push-uvedomleniya-ot-teorii-k-praktike\/"},"modified":"2019-10-31T22:04:52","modified_gmt":"2019-10-31T19:04:52","slug":"bezopasnye-push-uvedomleniya-ot-teorii-k-praktike","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnye-push-uvedomleniya-ot-teorii-k-praktike","title":{"rendered":"Njoftimet push t\u00eb sigurta: nga teoria n\u00eb praktik\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

P\u00ebrsh\u00ebndetje, Habr! <\/p>\n

Sot do t\u00eb flas rreth asaj \u00e7far\u00eb ne dhe koleg\u00ebt e mi kemi b\u00ebr\u00eb p\u00ebr disa muaj: rreth njoftimeve push p\u00ebr aplikacionet mobile. Si\u00e7 e kam th\u00ebn\u00eb m\u00eb par\u00eb, n\u00eb aplikacionin ton\u00eb fokusimi kryesor \u00ebsht\u00eb n\u00eb siguri. Prandaj, ne kemi hetuar n\u00ebse njoftimet push kan\u00eb 'pika t\u00eb dob\u00ebta' dhe n\u00ebse po, si mund t'i eliminojm\u00eb ato, p\u00ebr t\u00eb shtuar k\u00ebt\u00eb opsion t\u00eb dobish\u00ebm n\u00eb sh\u00ebrbimin ton\u00eb.<\/p>\n

Po publikoj p\u00ebrkthimin e artikullit ton\u00eb nga Medium<\/a><\/noindex> me disa shtesa nga vetja. N\u00eb t\u00eb gjenden p\u00ebrfundimet e \u2018hetimit\u2019 dhe tregimi se si e zgjidh\u00ebm problemin.<\/p>\n

Po studiojm\u00eb materialin<\/h2>\n

\nN\u00eb modelin klasik, njoftimet push e b\u00ebjn\u00eb aplikacionet e mesazheve t\u00eb cenueshme ndaj sulmeve t\u00eb MITM (Man-in-the-middle, 'Njeriu n\u00eb mes'). P\u00ebr shembull, Google, Microsoft dhe versioni i vjet\u00ebr i iMessage d\u00ebrgojn\u00eb \u00e7el\u00ebsat e enkriptimit n\u00eb serverat e Apple \u2014 n\u00eb server ndodh autentifikimi i p\u00ebrdoruesve dhe dekriptimi i titullit t\u00eb mesazhit (ose i p\u00ebrmbajtjes s\u00eb tij).<\/p>\n

\"Njoftimet
\n
\nN\u00eb fund, ka nj\u00eb mund\u00ebsi p\u00ebr t\u00eb lexuar bisedat, duke fituar akses n\u00eb serverin e njoftimeve t\u00eb shtytura. Kjo do t\u00eb thot\u00eb se \u00e7do kriptim i bisedave \u00ebsht\u00eb i paefekt, pasi njoftimet e shtytura gjithsesi do t\u00eb lejojn\u00eb leximin nga pal\u00ebt e treta. Kjo mund\u00ebsi \u00ebsht\u00eb diskutuar m\u00eb holl\u00ebsisht nga autor\u00ebt e artikullit. \u201cKripto me men\u00e7uri\u201d<\/a><\/noindex> n\u00eb Xaker.ru, q\u00eb \u00ebsht\u00eb e dedikuar p\u00ebr metodat e kriptimit t\u00eb mesazheve. <\/p>\n

N\u00ebse mendoni se server\u00ebt e Apple dhe Google nuk do t\u00eb lejojn\u00eb asnj\u00ebher\u00eb rrjedhjen e \u00e7elsave t\u00eb kriptimit t\u00eb p\u00ebrdoruesve, mendojeni se punonj\u00ebsit e tyre kan\u00eb akses n\u00eb to. Dhe punonj\u00ebsit jan\u00eb njer\u00ebz.
\nPavar\u00ebsisht gjith\u00e7kaje dhe t\u00eb gjitha dob\u00ebsive t\u00eb njoftimeve t\u00eb shtytura, shum\u00eb mesazhere \"t\u00eb sigurta\", p\u00ebrfshir\u00eb Signal dhe Telegram, i p\u00ebrdorin ato. Ndryshe, p\u00ebrdoruesit do t\u00eb detyroheshin t\u00eb monitoronin manualisht mesazhet e reja, duke hyr\u00eb vazhdimisht n\u00eb aplikacion. Kjo \u00ebsht\u00eb shum\u00eb e pak\u00ebndshme, dhe konkurent\u00ebt e mesazhereve do t\u00eb ken\u00eb avantazh.<\/p>\n

Paranoja dhe sh\u00ebndeti i arsyes<\/h2>\n

<\/a><\/noindex>
\nN\u00eb projektin ton\u00eb, kemi filluar t\u00eb merremi me k\u00ebt\u00eb \u00e7\u00ebshtje disa muaj m\u00eb par\u00eb. Na duhej t\u00eb krijonim opsionin e njoftimeve t\u00eb shtytura p\u00ebr t\u00eb qen\u00eb konkurrues. Por n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, nuk duhej t\u00eb hapnim nj\u00eb vrim\u00eb n\u00eb siguri, sepse \u00e7do rrjedhje e t\u00eb dh\u00ebnave do t\u00eb d\u00ebmtonte besimin n\u00eb projekt.<\/p>\n

Megjithat\u00eb, ne tashm\u00eb kemi nj\u00eb avantazh t\u00eb r\u00ebnd\u00ebsish\u00ebm: mesazhi yn\u00eb \u00ebsht\u00eb i decentralizuar (t\u00eb dh\u00ebnat ruhen n\u00eb blockchain), nd\u00ebrsa punonj\u00ebsit nuk kan\u00eb akses n\u00eb llogarit\u00eb. \u00c7el\u00ebsat e enkriptimit jan\u00eb vet\u00ebm te p\u00ebrdoruesit, nd\u00ebrsa \u00e7el\u00ebsat publik t\u00eb biseduesve jan\u00eb t\u00eb disponuesh\u00ebm n\u00eb blockchain p\u00ebr t'u mbrojtur nga sulmet MITM.<\/p>\n

N\u00eb versionin e par\u00eb t\u00eb njoftimeve, ne vendos\u00ebm t\u00eb jemi shum\u00eb t\u00eb kujdessh\u00ebm dhe n\u00eb t\u00eb v\u00ebrtet\u00eb nuk d\u00ebrguam tekstin e mesazhit. Sh\u00ebrbimi i njoftimeve merrte nga nodo jo tekstin e mesazhit, por vet\u00ebm nj\u00eb sinjal p\u00ebr faktin e marrjes s\u00eb tij. Prandaj, p\u00ebrdoruesi shihte njoftimin 'Ka ardhur nj\u00eb mesazh i ri'. Leximi i tij ishte i mundur vet\u00ebm n\u00eb mesazhier. <\/p>\n

\"Njoftimet
\nSi funksiononte kjo: video<\/a><\/noindex>.<\/p>\n

Pas k\u00ebsaj, ne m\u00ebsuam se n\u00eb versionin e fundit t\u00eb njoftimeve nga Apple ka elemente t\u00eb reja mbrojtjeje. Ato n\u00eb l\u00ebshuan<\/a><\/noindex> UNNotificationServiceExtension, i cili u lejon zhvilluesve t\u00eb d\u00ebrgojn\u00eb t\u00eb dh\u00ebna t\u00eb plota t\u00eb enkriptuara t\u00eb njoftimeve p\u00ebrmes APNS. Pastaj, aplikacioni n\u00eb pajisjen e p\u00ebrdoruesit p\u00ebrfundimtar kryen dekriptimin (ose ngarkon t\u00eb dh\u00ebna shtes\u00eb) dhe tregon njoftimin. K\u00ebt\u00eb ne e mor\u00ebm si baz\u00eb p\u00ebr versionin e dyt\u00eb t\u00eb njoftimeve.<\/p>\n

Tani kemi zhvilluar versionin e dyt\u00eb t\u00eb njoftimeve push p\u00ebr iOS, i cili lejon shfaqjen e mesazheve pa rrezik p\u00ebr sigurin\u00eb. N\u00eb konceptin e ri, logjika duket k\u00ebshtu:<\/p>\n