Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature]: Send a warning in the XML from the server about sharing information #124

Open
1 task done
shutterbug2000 opened this issue Oct 24, 2024 · 4 comments
Open
1 task done
Assignees
Labels
approved The topic is approved by a developer feature A feature request

Comments

@shutterbug2000
Copy link

Checked Existing

  • I have checked the repository for duplicate issues.

What feature do you want to see added?

The server should include a warning that sharing data in the request or response from the server could result in impersonation of the user or their console.

Why do you want to have this feature?

Recently, a user had their console details stolen by a known bad actor using social engineering. A warning from the server will help prevent this, similar to the warnings many sites give upon opening the browser's developer tools console.

Any other details to share? (OPTIONAL)

I used Charles' rewrite feature to add <!--WARNING!!! DO NOT SHARE ANYTHING IN THE REQUEST OR RESPONSE WITH UNTRUSTED USERS! IT CAN BE USED TO IMPERSONATE YOU AND YOUR CONSOLE, POTENTIALLY GETTING YOU BANNED!!--> after <?xml version="1.0"?>. This appears to work without issue on all tested endpoints.
The message can be tweaked if needed, just needs to get the point across

@shutterbug2000 shutterbug2000 added awaiting-approval Topic has not been approved or denied feature A feature request labels Oct 24, 2024
@shutterbug2000 shutterbug2000 changed the title [Feature]: Send a warning in the XML from the server about sharing the traffic [Feature]: Send a warning in the XML from the server about sharing information Oct 24, 2024
@DaniElectra
Copy link
Member

This should be tested on the 3DS too. The XML parser is known to be picky there (at least on BOSS)

@jonbarrow jonbarrow self-assigned this Oct 25, 2024
@jonbarrow jonbarrow added approved The topic is approved by a developer and removed awaiting-approval Topic has not been approved or denied labels Oct 25, 2024
@jonbarrow jonbarrow moved this to In Progress in Pretendo Tasks and Goals Oct 25, 2024
@jonbarrow
Copy link
Member

This should be tested on the 3DS too. The XML parser is known to be picky there (at least on BOSS)

If comments don't work on the 3DS, then maybe adding this as just a totally custom field would be better?

@shutterbug2000
Copy link
Author

Tested on 3DS, appears to work without issues
Same method as Wii U, just jamming a comment in after <?xml version="1.0"?>
Was able to login to Juxt (altho it didn't load the webpage complaining about certs, but I think that's my patches being out-of-date)

@TraceEntertains
Copy link
Member

Juxt portal doesn't work with SSL proxying enabled but discovery does, just figured i would mention it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved The topic is approved by a developer feature A feature request
Projects
Status: In Progress
Development

No branches or pull requests

4 participants