yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy Nexus] [hfm]:
I've said that all along. Too many people root their devices not knowing what that means or why they need to.
[Samsung Galaxy Nexus] krichek:
Sounds like googles official response right now is pretty much the same lol.

http://thenextweb.com/google/2012/0...g-to-fix-a-major-google-wallet-security-flaw/
[Samsung Galaxy Nexus] xCaldazar:
https://market.android.com/details?id=com.noshufou.android.su.elite&hl=en

- Pin protection for Superuser prompt

^Would that fix this problem? Just wondering. Since they would need a pin to run their root app.
[Samsung Galaxy Nexus] xHausx:
When it comes to root the weakest link for security is usually the user. When you give an app root you're giving it system level access to everything and anything on your phone.

It's possible for an app to get root without your permission, but it's almost always easier to just ask for it instead.
[Samsung Galaxy Nexus] jonathan3579:
Well, I'm over it as quickly as it upset me but that's mainly due to the fact that I'm completely stock... it'll be interesting to see where this goes. I wonder if Google's implementation for a fix will be to block Google Wallet for rooted devices like they do with movies.
[Samsung Galaxy Nexus] lukegb:
I was the one without the data connection, and was using my Google Prepaid.

Obviously the merchant needs a data connection to verify and authorise the transaction.

Sent from my Galaxy Nexus
[Samsung Galaxy Nexus] gogol:
I read the vulnerability description and I still don't quite understand why it is really an issue.

Because, this is pretty much the same as loosing your wallet with your signed credit card in it. The thief can then use that credit card easily. Faking hand-sign is easy and most if not all credit card don't have photo in it.

What to do during lost / stolen credit card? Call your bank immediately to block any future transaction.

This should be the same when you loose your phone with Google Wallet in it ...

You should call your bank and do the same to block transaction.

I would say, don't loose your phone :) ... and do the right thing when that happen.

Of course, there is other thing like "rooted" phone, where a hacker might steal that pin data? But without the physical access to the phone, isn't useless?

Then again, don't loose your phone ...

Even, if I got fraud transaction (it happened in the past), I called the bank and explained it was fraud ... They write it off !

Again, another protection from the bank ...

So, I am not worried at all with this suppose to be vulnerability. Credit card is not safer anyway and we use it every day.

Unless ... I am missing something more important???
[Samsung Galaxy Nexus] EvanVanVan:
@miasma: What "banks" are you referring to? Citibank, Money Network? Just wondering who is in control of the SE and who the fate of this vulnerability's fix lies with...
[Samsung Galaxy Nexus] distortedloop:
I have two NFC devices with Google Wallet installed. One is a T-Mobile Nexus S with no sim card installed. I have used it multiple times to make purchases at the local 7-11. There's no SIM and no WiFi, therefore no data, yet it works flawlessly each time.

My understanding, and experience, of the data connectivity requirement is that no data is required at time of purchase, and the transaction will go through, but if you don't get data-connected within a short time-period, the transaction history and balance data on the phone itself won't record. I have seen this happen with the transaction not recording personally.

---------- Post added at 05:42 AM ---------- Previous post was at 05:31 AM ----------

A video proves nothing. Seriously.

It would be very easy to fake the particular video: write a simple app that does nothing except display the message "your pin is: 1234" the first time you run it, then "your pin is: 2468" the second time you run it. Then make a video of you running wallet with the first pin, running your simple fake app, then running wallet with the second pin, then running your app again. The resulting video would be exactly the same as the one shown. It proves nothing other than you made a video.

I already use a secure pattern protection lock-screen, have Lookout installed for remote wipe and find services, and only use Google Prepaid in Wallet. I don't feel threatened at all with this vulnerability. Obviously I'd like to see it fixed, but I'm not going to panic and freak out over it.

Like others have said, our real credit cards are so insecure it's a joke. How do you know when the waiter takes it from the table they aren't running it through one of those card readers that steal the data on it? One thing with my phone, I'll never be handing it to a waiter and letting him take it out of my sight. With my Amex card, I do it almost daily.
[Samsung Galaxy Nexus] silent_killa:
If you need to be rooted to run this apk then a quick fix from google could be to run a root check each time wallet is initiated and deny access if root is found. Perhaps this could also be extended to check that the phone has a protected lockscreen....

Workarounds I know.
[Samsung Galaxy Nexus] govindadas:
question is, how risky this is for citi mastercard users vs google card users. I dont have a citicard, and just top up the google card every now and then. So theoretically, I should have a limited amount of cash to steal... I'd be more worried about the lost phone.

Also, why couldnt other saved passwords on the device be hacked in a similar way? such as gmail, facebook, or any other browser saved passwords, etc... even though they may not link directly to a bank account, they can still be used to mine massive amounts of data, in addition to call records, contacts... plenty of other id theft type data to worry about...

I at first thought releasing the crack publicly was a bad idea, and still kinda think it is. Although if the device still has to be physically possessed for the pin to be of value, then it's just not really all that big a deal...

anyways... I keep my phone close at all times, treating it like it holds the same value as my laptop (actually, the laptop is 5 years old and is not much more powerful than the phone, so its probably worth less than the phone!).

Rule #1: Where is my phone? Left pocket. Ok, check.

Rule #2: Where are my keys and wallet? Right Pocket. Ok, check.

Good to go.
[Samsung Galaxy Nexus] case0:
I think it's proof enough to release a video and have Google admit that it is indeed true and a real problem, which they did and would have - just like with the Carrier IQ incident. Instead this supposed white hat acted more like a black hat IMO. That's what bothers me about it, I'm not actually personally effected by this.
[Samsung Galaxy Nexus] Natolx:
This doesn't allow someone to do anything super crazy hacking. They have to STEAL your phone physically to do this. Its just like stealing your wallet
[Samsung Galaxy Nexus] cwoggon:
I must say I am extremely surprised by all of the outrage in this thread. I would expect comments like these on a less technical(?) website (i.e. engadget), but here? Amazing...

For those of you who are still outraged please re-read the quotes below - hopefully they will provide some perspective...
[Samsung Galaxy Nexus] codesplice:
I'm right there with you. This *is* a forum centered around hacking or otherwise modifying our devices. If the open and detailed discussion and documentation of security vulnerabilities makes you angry, your time would probably be better spent on one of those less technical websites.

As to the issue at hand, I'm not terribly concerned. My phone is rooted and I use Wallet every chance that I get. I also have a pattern-protected lockscreen, use 2-factor authentication for my Google account (so could easily remove my phone's access to my account and Wallet if need be), and have Avast Anti-Theft installed (as root) to locate, lockdown, and remotely wipe my device should it come up missing.

It would suck to replace my phone if it were stolen, but I feel much safer about my personal and financial data on my phone than I do about getting my physical wallet stolen.

Cheers to the OP for identifying this vulnerability in a mature and ethical way, and thanks for keeping the needless fear-mongering to an absolute minimum.
[Samsung Galaxy Nexus] miasma:
Regarding the second vulnerability announced today. This is the issue where, by uninstalling or resetting the Wallet App, and then re-configuring it for the same user, they are given the chance to enter a new PIN and will gain access to the previous user's prepaid card.

We had planned on not disclosing this vulnerability until later, but since it is already public, I can report that we were aware of it as well.

We reported it to Google on January 4th and they are presently working on a fix for it.

The fix involves, partially, linking the prepaid account to the users GAIA (Google account) instead of the hardware device ID. But they still have not confirmed to me how they will challenge a user to prove their identity before re-activating a previously activated prepaid card.

Please note that this issue ONLY affects people's pre-paid accounts, not Citi MasterCard or any other type of account in Google Wallet.
[Samsung Galaxy Nexus] codesplice:
An important detail right there. I don't have a Citi card so the pre-paid card is the only one in my Wallet, but I never keep more than ~$50 on it - about the same amount of cash that I try to keep in my physical wallet.

I still think I'm better off losing my phone than my wallet - aside from the other protections I have configured on my phone, I can promptly change my Google password which will prevent Wallet from being reactivated on my phone even for the meager $50 sum.
[Samsung Galaxy Nexus] supern0va:
Firstly, congrats on uncovering this exploit, devving a proof of concept, and publicly disclosing this info. Upon downloading and installing the cracker .apk I got an error parsing file. I did move the file from the internal to external storage, but I doubt that would change anything. Is it because I am not running 4.0+ ?

thanks in advance
[Samsung Galaxy Nexus] miasma:
Yes, the app requires Android 3.2 as a minimum. Sorry.
[Samsung Galaxy Nexus] Nick N:
Any progress on the Secure Element not responding error? I'm sure you have received enough error reporting data to do a comparison between phones with and without this problem.

My Secure Element transaction count was -1 and my Secure Element initializing was false.
[Samsung Galaxy Nexus] miasma:
Actually, your report is the first I've received. I do not automatically collect this data, it has to be reported to me by the users.
[Samsung Galaxy Nexus] Nick N:
Feel free to contact me with any questions. Google Wallet was the main reason I purchased this phone, and I would like to use it. :D
[Samsung Galaxy Nexus] cordell12:
So now Google Wallet is turned off due to these exploits, yay. If someone finds my phone or steals it they can install a app that allows them to purchase a Happy meal at McDonalds :rolleyes: I would think the $20 I keep on my now turned off prepaid card is the least of my worries :mad:
[Samsung Galaxy Nexus] Nick N:
Google Wallet was intended to be more than point of purchase. It is the replacement for Google Checkout, so it would also be used for online purchases as well. I would still use this app despite the current vulnerabilities, as others have pointed out it is still more secure than a plastic card. Also, I would not even think about linking a debit card or bank account to this thing, but a Chase Visa credit card for sure. I just wish someone could find a way to reset the Secure Element so I can start using this thing!
[Samsung Galaxy Nexus] miasma:
We have just added a new post that details why users who have not already rooted their phones are still at risk from these Google Wallet issues. We believe there was a lot of confusion about what it means to be rooted as compared to just attaining root privileges.

The issues we bring up, surrounding privilege escalation vulnerabilities, have grave consequences for android (and all mobile device) security, not just Google Wallet.

Hopefully our discussion of these issues will make developers more aware of them before they are written into new apps.

https://zvelo.com/blog/entry/google-wallet-security-about-that-rooted-device-requirement
[Samsung Galaxy Nexus] jonathan3579:
Okay, well Google resolved the non-rooted issue so I don't see much point for mentioning anything other than the root exploit anymore...

If you're rooted and someone uses the tools provided in this thread, it's your own fault. End of story. My sympathy and paranoia have worn off...
[Samsung Galaxy Nexus] codesplice:
Well-written, informative write-up. Bravo, good sir, and thanks for continuing to provide updates on the situation without resorting to FUD like some media outlets are.

Cheers!
[Samsung Galaxy Nexus] distortedloop:
Google admitting/announcing the flaw is self-proving, it doesn't need a security researcher's (or hacker's) video to prove the existence of the flaw.

As I suggested in the post you quoted, the researcher's video, on the other hand, is so easy to fake, that it proves nothing UNTIL Google acknowledges the video's issues are real. The researcher here reported the bug/flaw to Google 6 weeks ago, yet Google didn't do anything about or acknowledge it until the researcher went public with it, so for all we know, Google would still have been silent on it even now if this sh*t hadn't hit the fan.

I won't debate the merits of releasing the demo app with you, but it was the only thing that PROVED the flaw was real to me, until Google admitted the issue was real.

In light of physical possession of the affected device is required to exploit the hack, I've got no problem with, and actually want to THANK the researcher for releasing this and making it publicly known.
[Samsung Galaxy Nexus] staxchipswell:
Support this post!

This post is shaping the way we use NFC! I think it is very important that google gets this worked out quickly. I used the google prepaid card on stock nexus s 4g 2.3.7 and could see the problem. Now I am rooted with the leaked 4.0.4 ROM and want to no if google will leave rooted users out in the cold.?

If I could only use Paypal NFC at 7-11.:D

Anyone with negative comments doesn't understand that posting the .apk is done for the greater good.

Thank you for your hard work.
[Samsung Galaxy Nexus] lpasq:
....deleted.....
[Samsung Galaxy Nexus] mk1987:
Thank you very much.

I found the hashed PIN in the Google Wallet DB, but i really can't find the SALT. Can you help me? :)
[Vibrant Themes and Apps] kiazand:
does anyone know any good app drawers for miui ? other than go launcher?
[Vibrant Themes and Apps] robsoncgrj:
You don't need an App Drawer for MIUI. You can just create a folder and drag all your apps into that folder (name it "Apps" for example). Then drag this folder to the center of your dock bar and that's it!

But if you want an app for that anyway, use the search, I know there is an app for that here :)
[Vibrant Themes and Apps] fear676:
That's what I did and it works great
[Vibrant Themes and Apps] N00B_IN_N33D:
Straight from my Miui guide posted in the Q&A section...

Lags a bit the first time you launch it, but it still is a good resolution to Miui's lack of an app drawer.
[Galaxy S II Q&A, Help & Troubleshooting] hamik5:
Hi there.

I have a problem with my phone. It seems to have stopped being able to connect via USB cable as mass storage.

I did perform a software update via settings menu before this problem occurred so it might be the reason.

My current version of Android after stressful update is described in the screenshot below.

View attachment 893551

I did try different Samsung USB cables and different USB ports on my Windows 7 laptop.

I have found several threads with the same problem but couldn't find anything useful for me there. The only advise I got was to try and reset the phone to factory settings.

Would anybody help me with this?

Thanks in advance,

Victor
[myTouch 4G General] chukis13:
It's been real guys, but I just traded the mt4g for a sensation. Appreciate all the devs here. Febycv keep up the good work. Peace all!
[myTouch 4G General] tradejak66:
Don't say bye. Your not leaving, your just leaving the mytouch 4g section :)

I dont like when people say goodbye... say see ya later or something. Feels better
[myTouch 4G General] saranhai:
Wow a Mt4g for a sensation?? Niceeee...

-Team Inferno

"Quality, not speed"
[myTouch 4G General] chukis13:
Yeah, dude's wife really wanted a mt4g. He didn't seem very tech savvy either.
[myTouch 4G General] saranhai:
you got lucky hahaha :D

how is the Sensation?
[myTouch 4G General] aznprodgy:
even trade?? man that dude was a sucker, but I guess anything to please the wifey lol :)
[myTouch 4G General] GazaIan:
Do you think it's still worth getting it? I want to get it, but flagship times is just around the corner...
[myTouch 4G General] saranhai:
Heck yes. Totally worth it. I really want one...

-Team Inferno

"Quality, not speed"
[myTouch 4G General] silentsnow31802:
As a user that has had both. I took the MT4G over the Sensation. There is no need for that much power in a phone right now plus the battery life on those things is TERRIBLE. However from a money standpoint, I would straight trade the MT4G for a Sensation any day lol.
[myTouch 4G General] chukis13:
Totally worth it in my eyes. This is more than enough phone for me so I won't be upgrading anytime soon. The dev community is really strong too. Already put virtuous quattro on it and it's amazing. Tried out some of the sense ics roms but I like vanilla ics best.
[myTouch 4G General] Snakecharmed:
I've been thinking of getting a Sensation myself for the last couple of days after my bad eMMC MT4G ate it, but the more I look at my options, the more I'm leaning towards getting another MT4G provided that I get one with the good eMMC and screen.

The Sensation's primary issue is signal strength. It annoys me that I have to limit my options for which case to buy so that it doesn't have a role in degrading the signal. Also, I prefer using Wi-Fi over 4G because I'm on a simple data plan, and it's unacceptable to me for the Wi-Fi antenna at the top to be extremely susceptible to a death grip that I have to hold the phone a certain way in landscape mode, and likewise I can't hold the phone by its bottom unless if I also want to degrade the mobile signal as well. I can hold the MT4G with two fingers using the TPU Fusion case, but I don't do it. Why would I do that with the Sensation, with or without a case? If I can give Apple crap for their iPhone 4 inconveniences, I will do the same to HTC. It's not acceptable.

To me, my phone still needs to primarily be a phone, then a mobile Internet device and GPS, then a PDA, and lastly, a time-waster. As great of a device as the Sensation was spec-wise for 2011, it comes up short in too many practical categories. The signal strength, battery life, and speaker volume (for which there is a fix) are all worse than the MT4G. Even though I would like the larger, higher resolution screen and dual-core processor, I don't make use of those things enough for them to matter.

That said, I still hate the idea of playing panel and eMMC lottery to get a good MT4G. If the Sensation didn't have its issues, I may have gotten one the first time around, because I really like the phone otherwise.

Of course, when it comes to trading the two phones, that's a no-brainer because you're basically making $50-100.
[myTouch 4G General] chukis13:
Weird, I've not had a single issue with signal of any kind no matter how I hold it. Use my wifi at home at all times and haven't had any issues with my 4G either. Also I get great battery life on ics, just as good as I did with my mt4g. Speaker volume also not an issue. Have you had one of these? Cause I have absolutely zero doubts about making the switch and would never go back.
[myTouch 4G General] Snakecharmed:
I haven't. Those are all the complaints I've read in the xda Sensation forums. What it boils down to for me is whether I want to spend the extra $80-100 for hardware that I know I won't put to maximal use and a new set of problems. It may not be every handset, just like not every MT4G has a bad screen, bad eMMC, squeaky buttons, or whatever else. However, the Sensation does have its share of problems and the ones that it has are potential deal breakers to me, regardless of what another user's tolerance, threshold, or experience is.

I haven't ruled out the Sensation yet, but it's hard for me to pull the trigger on either a second MT4G or a Sensation knowing that both of them have the potential to be a bigger pain in the ass than any phone I've owned before the last MT4G. What's frustrating is that those are my only candidates at this point because nothing else appeals to me nor is in my budget. I've only started to take a liking to some Samsung and Motorola smartphones based on their late-2011 models, but those are way out of my budget and I know I'd want to switch to AOSP immediately with those phones.
[myTouch 4G General] madmanmostafa:
You know, if I had to replace my MT4G, I'd just go for a Galaxy S. They're easy to root and there's a decent amount of support. And everything works on ICS. I'm just not a fan of the build quality. I'd be using my Galaxy S if it wasn't for the fact that it feels cheap and plasticy. My MT4G is like a lump of steel by comparison (which is good).
[myTouch 4G General] adolfo778:
word to that brother! I hate the build quality of the Galaxy S, however the build quality on the mytouch 4g is awesome!

I recently traded a HD2 and for a Mytouch 4g and I was lucky enough to get one with a good eMMc chip and display :D
[myTouch 4G General] madmanmostafa:
Haha. Yeah. I tend to keep my older phones, and when I was gifted the Galaxy S, I switched back to my MT4G. In fact, build quality was what kept me with Blackberry for so long. After I was given my MT3G Slide, I got hooked onto android because of flash support. That and I could easily play SNES emulators.

It's a shame to see people move away from the phone. Especially with the recent news that perhaps we could start getting full functionality from ICS because of the other similar phone's official ICS upgrade.
[myTouch 4G General] saranhai:
+1 on the bad build quality. I got the international version, GT-I9000, the build kinda sucks... Haha

-Team Inferno

"Quality, not speed"
[myTouch 4G General] Snakecharmed:
I think I've decided to save my money and get another MT4G for now while keeping my eye on the Amaze or whatever else might become a good modder phone when it's truly time for me to upgrade.

I know some people here like to upgrade phones like they're leasing BMWs, but my phone is not a status symbol. I'll just take a solid, good-looking form factor with sufficiently powerful hardware for my needs, because once I'm done rooting and flashing a new ROM, I don't mess with it again.
[myTouch 4G General] LBN1:
I've got a Sensation and MT4G, and I switch back and forth in use. Spec wise the Sensation may seem a lot better on paper, but here's my perspective in comparing the 2 in real life.

Sensation pluses:

* Screen size & resolution

* 8 MB Camera and 1080p Camcorder

* More active development, so quicker path to ICS

Sensation minues:

* Antennas built into the rear cover - arguably a defective design; harder to do a simple battery pull; not nearly as solid as the MT4G design with its metal battery cover; and generally the MT4G seems to get better reception too.

For most other items, like battery life, speed of use with or without Sense, lack of lag, built in memory, 4g speeds, browsing, etc., the devices are very similar if not about the same. Dual core in the Sensation is nice, but on both of my devices I only OC to about 1.2 ghz and they both (with the right GB rom) have the same smoothness and similar benchmarks. Sensation is just like a slightly newer brother to the MT4G IMO.
[myTouch 4G General] DonDizzurp:
hows the sensation? thats the only phone right now id upgrade to

im thinking of holding off for now though

WHY DOESNT HTC BELIEVE IN HARD BUTTONS ANYMORE