Comment on Does Shuzku / wireless debugging demand a trusted wifi device?

Successful_Try543@feddit.org ⁨4⁩ ⁨days⁩ ago

• wyfpm@lemdro.id ⁨4⁩ ⁨days⁩ ago

  Fair enough, thanks.

  I know it’s the app itself that executes adb commands. I just wonder.

  shizuku.rikka.app/guide/setup/

  It says, allow debugging on this network.

  So what you’re saying is, this is somewhat misleading, for this step doesn’t automaticallh grant all devices on the network debug-privileges; and were the modem itself, somehow, applying for them, then it wouldn’t have asked for the code as Shizuku is doing, via a notification?

  source

  • FooBarrington@lemmy.world ⁨4⁩ ⁨days⁩ ago

    1. You don’t need to be connected to a network to set Shizuku up. Even while you’re not connected to an external network (through Wifi or mobile data), your phone has a “loopback” network that allows applications on your phone to talk to other applications as if they were connected through an external network. So if you’re scared of giving access to the wrong thing, just turn off wifi & data.
    2. When Android asks you to approve an external debugging connection, it’s approved for the specific device that’s connecting. Other devices on the network are not allowed to connect. If I use my computer to connect wirelessly to ADB, only my computer can execute commands, not other devices on my network (they’d show another popup).

    Hope this helps!

    source

    • wyfpm@lemdro.id ⁨4⁩ ⁨days⁩ ago

      Perhaps my question had semiconsciously stemmed from this:

      Why would Android ask me to authorize a whole network for wireless debugging, if it then proceeds to demand device-permissions anyway?

      I understand it is just a second layer of security, or, a relic of times when wifi connections were unencrypted. But if so, then wireless debugging should be just unenanable if elsewhere in Android settings, insecure wifi networks are enabled / if you presently are on one.

      (Is adb encrypted anyway, as a protocol itself? If I authorized, say, my laptop, wirelessly, would the modem be able to read my comments? Those aren’t questions for you, btw, just musings. I should probably hit ai / Github for those.)

      source

      • FooBarrington@lemmy.world ⁨4⁩ ⁨days⁩ ago

        Ah, sorry, seems like I was wrong on the whole “no network connection needed”, but the reason is the explanation for your question!

        The only way for your phone to recognize/authenticate the source of an incoming ADB connection is the MAC address. Basically every device that sends/receives ethernet packets has to have a unique “fingerprint”, so everyone knows it’s still the same device if it disconnects & reconnects etc. Everything else (IP address etc.) can change at any time, so the MAC address is the only fingerprint available.

        But devices can spoof (change) their MAC address. That’s a really useful feature in many cases, e.g. phones these days use a random MAC for every new network, so a network provider can’t track you moving through multiple different networks. Also there’s no way to prevent it with our current network design. But this means that a malicious actor could wait for your trusted device to disconnect, then change their MAC to the one from your trusted device, and thus send malicious ADB commands.

        Androids solution is to make you trust both the network and the device. So as long as you don’t have malicious actors in your trusted network, you’re safe - even if you connect to a different network with malicious actors, they can’t send ADB commands.

        source

        • -> View More Comments
    • wyfpm@lemdro.id ⁨4⁩ ⁨days⁩ ago

      Alright, sweet. Ty both vm.

      I’d think i had tried starting Shizuku up without a connection. Just now, I tried to enable wireless debugging without wifi on, and Android said i must turn it on first, but perhaps I can turn it off afterwards, the say you can be on airplane mode then turn wifi on. (This once helped my online radio app cease to leak my system language for some reason.)

      Will edit this post will further report.

      source