Is there any plans to release a mac desktop client with the Mondo interface to view transactions, stats etc on your computer?
Or possibly a web version?
3 Likes
Its possible to use the URL protocol used in the Mondo app for a desktop client, so the âLog in to Mondoâ button .
The problem is iOS binaries are encrypted and mostly all other binaries are not protected at all, this would make it too easy to find out Mondo works - as their login link says it does âmagic authenticationâ.
Iâm pretty sure Mondo arenât using security by obscurity. Where does this information come from?
Youâre right, security through obfuscation is not security. iOS does not obfuscate the binaries - maybe does now but didnât when I last looked - it actually encrypts them.
I presume, without actually looking into it further, the âLog in to Mondoâ button calls a URL with a token as a parameter, this endpoint once verified then will redirect you to a URL protocol for Mondo - as an exmaple âmondo://magic-link/1234567890â - which will advertently open the Mondo app.
This process flow should also work for a Mac application, even a Windows one.
Okay, so whatâs âmagicâ about email authentication/ universal links, and why does this cause problems for someone whoâd want to make a desktop client to view transactions/stats? And how is it not security by obscurity if theyâre relying on the fact that the iOS binary is encrypted to make it not âtoo easyâ to find out âhow it worksâ?
(Sorry for all the questions, Iâm not trying to be a pain, I just want to know what Iâm missing here 
)
The Mondo public API including OAuth 2.0 strategy is documented here.
Theres nothing âmagicalâ about the authentication links, theyâre just timed token links I guess. If someone wanted to make a desktop client you can, there is no problem with using the method Mondo uses for iOS.
Lets just make this clear, youâre calling it âobscurityâ which is not the correct term I am trying to use - the saying is usually âsecurity through obfuscation is not securityâ. Obfuscation is not encryption. An executables code can be obfuscated or not and the execution will still happen the same way, with an encrypted exe the actual instructions have to be decrypted before they can run - along with Apps from the App Store being signed by Apple themselves - it makes it harder to find out how the process works. I am not saying its impossible, as nothing is unhackable, you just have to put in so many roadblocks that you deter people.
The term Iâm using is security by obscurity, which is a distinct term with its own Wikipedia page and describes an approach to system security, not just a matter of obfuscation vs. encryption of binaries.
My initial reply was simply asking what you meant when you said:
The problem is [âŚ] mostly all other binaries are not protected at all, this would make it too easy to find out Mondo works - as their login link says it does âmagic authenticationâ
My comment was that if Mondoâs security hinged on the fact that their app binaries are encrypted (which Iâm quite sure they donât), this would not be a wise strategy.
I assume Iâm misunderstanding your original post, in which case my bad 
Ah sorry my bad! I didnât know you really meant obscurity - I have to deal with a lot of employees that donât understand terminology so I have to guess at what theyâre trying to say, which I donât have to here .
I was just trying to point out that the Mondo app is natively protected by iOS security, which makes it hard (not impossible) to find how the authentication works. Mac apps are also protected by OSX. Android and Windows (notably .NET) are so easy to unpack anyone with a knowledge of google and keywords can find an unpacker - especially Android APKs as its just a silly version of a ZIP file 
- they are just not protected at all its so easy to research and patch executables.
Sorry for the misunderstanding 
. Theres a reason I donât talk to customers at work, my brain goes a million miles an hour and my fingers canât keep up with the demand, I tend to sometimes confuse people. 
The issue I see with this at the moment is that to authenticate with modno, you have to click a link recieved via email that opens in your browser. This means that we can easily create a mondo web app that you will view in your browser, but probably makes it a bit harder to create a dedicated standalone desktop app.
I donât know how easy it is to force your os to open a link within another app.
No worries! I only pressed you because comments from fellow devs that donât make sense to me play havoc with my imposter syndrome.
Still, (though I havenât checked) the auth process theyâre using in the app is probably identical to the one documented in their API. Also, if I wanted to reverse engineer what is essentially an API transaction I would be MITMing myself to inspect the actual requests made long before I resorted to inspecting executable code. But thatâs just me
@anon98847739 Youâll probably want to register a custom URL scheme for your app (e.g. mymondoapp://, implementation varies by OS) and use this in the redirect_uri of the âAuthorization code grantâ step of the auth process.
(Yeah, authorization. International ambitionz yâall)
Worth noting - compiled Obj-C iOS apps are actually much easier to reverse engineer than most binary formats.
Itâs not as trivial as a simple APK, but if you dump an Obj-C iOS app into Hopper, youâll find that almost every code-path is helpfully labelled with its selector, which makes even ASM relatively readable.
Swift is not as heavily affected by this, as most of its symbols are stripped at runtime. Obj-C canât really have its symbols stripped properly, because Obj-C selector messaging is built entirely on strings.
1 Like
I have heard of this before, but didnât read into it much. 
I donât believe you are correct saying âmuch easier to reverse engineer than most binariesâ, you may get to the headers and paths etc. I know that the apps are protected by Appleâs DRM system, which encrypts segments of the app (not the paths for example), and the keys are unique per device also.
Its possible using a jailbroken device to get the keys to decrypt the application - but jailbroken to me is non-existent as I see 0 point in it.
As with anything - nothing is impossible to reverse enginner (I know I had lots of fun with PPC). I do believe though that iOS apps are protected better than .NET (Windows), Java (Android), etc, donât you agree?
I have found usually that if you just download the binary through the Mac version of iTunes, nothing seems to be protected in any meaningful way.
Maybe iOS and OSX apps are protected differently. Thatâs interesting, I will look into that Iâv got a few Mac apps that I want to know how they work 
.
Interesting, the same is not true for me with IDA. Hopper will accept it but ultimately fails to actually produce a useful disassembly. I generally have to run iOS binaries through private tools before I can RE them.
Do you intend to share the code?
Hey! A friend and I are currently working on a Mac client. No promise of when it will launch as weâre just working on it during our spare time but you can sign up for the beta here
Hereâs a little sneak peek - https://twitter.com/quidsapp/status/722008388423561216
Cheers, Red
6 Likes
Signed up. Love a good native mac app. 
1 Like