Unsafe implementation of TrustManager - android-security

I'm trying to publish an App on Google Play, but I'm getting an email with this error message: Vulnerability TrustManager, apps containing an unsafe implementation of TrustManager.
To properly handle SSL certificate validation, change your code in the checkServerTrusted method of your custom X509TrustManager interface to raise either CertificateException or IllegalArgumentException whenever the certificate presented by the server does not meet your expectations.
I'm using these libraries in my app: compile 'com.squareup.picasso:picasso:2.5.2' compile 'com.squareup.retrofit2:retrofit:2.0.1' compile 'com.squareup.retrofit2:converter-gson:2.0.0' compile 'com.squareup.okhttp3:okhttp:3.3.1'
Could you give me a cable to solve it,
Thanks in advance

I found the problem, it was the PayPal_MPL.jar who blocked the submission on Google Play.
This link allows to solve this problem:
https://github.com/paypal/sdk-packages/issues/72

Related

Are firebase messaging errors localized?

I am using firebase v4 to push notifications to android devices. When the Send method of the instance of messaging.Client fails, I only get a string error value and I wonder if this error string is localized. If not, I could compare it against e.g. "Requested entity was not found." to detect devices that have uninstalled my app. Is this string always plain english or does this depend on the locale the app is running under? Or does this error string come from the server, so I can never be sure if it stays the same?
What other options do I have to properly detect such an error, even if my golang binary runs on computer systems with any locale or language? I am running my golang binary on windows.
Any help or insights appreciated,
--
Stefan
In general, all error messages from Firebase SDKs are in English only. They are generally not suitable for display or comparison in an app. You should instead use the provided error codes (which will not vary) in the error or exception object to determine what exactly went wrong.

How to check if the biometric scanner is available and initialized in Xamarin android BiometricPrompt

Failed biometric(fingerprint) scan attempts are handled by OnAuthenticationFailed() callback of BiometricPrompt.AuthenticationCallback class.
The behavior I noticed is, it lets the user attempt 5 invalid fingerprint scans (each time the fail callback is invoked) and then the prompt dismisses. Within the next 30 secs, if we try to re-build a BiometricPrompt instance and try to authenticate, it does not show the prompt which I think is the default behavior of BiometricPrompt.
Is there anyway to check if the biometric scanner is available and initialised if the user attempts to re-invoke biometric prompt within the said 30secs?
How can I handle that use case?
xamarin android BiometricPrompt.AuthenticationCallback does not have an override method "onAuthenticationError" to handle error callbacks and thus I'm unable to handle error code "BIOMETRIC_ERROR_TIMEOUT".
If someone has a solution for this, please do let me know your resolution.
I believe that BiometricPrompt is not fully ported to Xamarin yet...
I'm still looking for a source that can double check this info for me, but I haven't found it either.

How to fix ERROR_NOACCESS = -7 in google pepper plugin API

From NACL SDk examples i am trying to run socket example. Example available at ..\nacl_sdk\pepper_34\examples\api\socket
While i am trying to connect to google.com:80 using TCP socket, given error is flashed:
Resolving ...
Resolve failed with status-7
After googling i found ERROR_NOACCESS = -7, Indicates failure due to insufficient privileges.
Does anyone come across this error?
What can be the reason for that, and what is the fix for this?
In order to use TCP/UDP sockets in a NaCl app, you have to create a packaged app in the Chrome Web Store since these permissions require an accept gesture from the user.
https://developer.chrome.com/apps/app_network
"Apps permission socket with subrule tcp-connect is required for Connect(); subrule tcp-listen is required for Listen()." - https://developer.chrome.com/native-client/pepper_dev/cpp/classpp_1_1_t_c_p_socket

TB.Socket error with OpenTok WebRTC on Meteor

Got a tough one here.
So, we're trying to upgrade an OpenTok video chat application from Flash to WebRTC, and are running into socket errors as we try to implement the 'helloworld' WebRTC sample. The errors occur when we try to do a session.connect() call, not when we request a sessionId or a token. And the error basically looks like this (session_id and partner_id anonymized):
SessionInfo Response:
#document
<sessions>​
<Session>​
<session_id>​asfgdagbasdfovnwoinvcwoinvoiandfvoinvoidnofgfdfgfgivniodfnv-sdfgdfgdfg-​</session_id>​
<partner_id>​1234567890​</partner_id>​
<create_dt>​Sun Sep 01 12:00:45 PDT 2013​</create_dt>​
<session_status>​INFLIGHT​</session_status>​
<media_server_url>​…​</media_server_url>​
<p2p_server_url>​rtmfp://p2p101-oak.tokbox.com:1945/multicast​</p2p_server_url>​
<media_server_hostname>​oms409-oak.tokbox.com​</media_server_hostname>​
<messaging_server_url>​oms409-oak.tokbox.com​</messaging_server_url>​
</Session>​
</sessions>​
connectToMessenger
WebSocket error: undefined
TB.Socket Error :: The socket to oms409-oak.tokbox.com received an error: Unknown Error
TB.exception :: title: Connect Failed (1006) msg: TB.Socket Error :: The socket to oms409-oak.tokbox.com received an error: Unknown Error
Any ideas on what might be causing this? We're testing on the latest version of Chrome 29, and it happens in both localhost and on our production servers. So it doesn't seem to be a firewall. The one thing I can think of is that we're running on a Meteor/Node.js framework, which has websockets enabled by default. The code is pretty much boilerplate helloworld sample from the following:
http://tokbox.com/opentok/tutorials/hello-world/js/demo.html
We get the sessionId and token successfully, it's just that the session.connect() doesn't ever happen (and, thus, we can't ever get our connection object or subscribe to the event listeners).
Any ideas on how we might go about debugging this issue?
Thanks in advance for any help!
abigail
In typical fashion, after I spend two days on a bug, get so frustrated that I post a question to StackOverflow, and then figure it out an hour later.
Long story short, the OpenTok account had an 'enable WebRTC' option that wasn't set. It was an account administrator issue. Long story short... make sure devs have access to the accounts the business folks have!
I think you might be using the flash js library instead of the webrtc library. If you had joined your session using flash, it will not be able to work with webrtc.
Here's the webrtc library:
<script src='https://swww.tokbox.com/webrtc/v2.0/js/TB.min.js'></script>
Here is the flash library:
<script src='https://swww.tokbox.com/v1.1/js/TB.min.js'></script>
Think of webrtc and flash as two separate products, they do not interoperate.

Flex Module throwing security sandbox violation

I converted a standalone Flex app into a module. Now that it's a module, when I login (and call the backend services), I'm getting a security sandbox violation.
The login handler throws this fault String: 'Send Failed', with a more descriptive: 'Channel.Connect.Failed error NetConnection.Call.Failed: HTTP: Failed:url: 'http://myUrl:8080/AppManager/messagebroker/amf'.
Then the FB console throws an 'unhandled security sandbox violation error'.
Can converting an app into a module cause a sandbox violation?
Thanks for any helpful tips.
I'm making extensive use of modules and haven't run into this. There are memory issues I ran into that I had to fix by actually declaring an instance of the modules in the main modules...I didn't have to create an instance, just declare a variable to get the linkage right, then have all the other modules compile against that main module. Memory errors went away, and all the other modules were much smaller too.

Resources