Over the past days we went through PockyAPP’s security from the server to every app and tightened a lot of things. The server and web changes are already live. In the apps they arrived in Android as version 0.10.3-Fix #2 and in Windows as version 0.10.3-securityfix.
Server: fewer opportunities for an attacker
Most of the work happened where you can’t see it. Login attempts are limited, so anyone trying to guess passwords is stopped quickly, and so is mass account creation. A new account is created only with a one-time invite code and a new password must have at least ten characters. The server’s admin interface is closed off from the internet and only the admin can reach it, directly on the server.
We also shortened the traces left behind. IP addresses of signed-in devices are kept for a week at most and deleted messages disappear from the database within seven days. Public room lists and profiles are visible only to signed-in people, and profiles only to those who share a room with you. The server doesn’t fetch links from messages, so outside websites can’t tell what is being discussed.
Web: even malicious code hits a wall
The web app now forbids the browser from running foreign scripts. Even if someone managed to inject malicious code into the page, the browser would refuse it. The web app also gets an app lock protected by a PIN and checks links the way the phone does.
Apps: control in the user’s hands
Four things were added in both Android and Windows:
- A lock that can wipe data. After ten wrong PINs the app signs out and deletes the data on the device. It’s turned on in the lock settings and it is entirely up to you.
- Link checks. Tracking parameters such as
utm_orfbclidare removed from links, and the app warns you when the link text points somewhere other than where it leads. - Signed updates. The app installs only an update signed by the developer. A forged file on the way doesn’t get through.
- The recovery key on the clipboard disappears on its own after a minute.
In Android, notifications on a locked phone now show only “New message”, and the system makes no backups or device-to-device transfers. In Windows, the map can’t be redirected to a foreign page.
What to do now
Update to the latest version. The app will offer it itself, or you can find it on the Download page.
Think carefully before turning on the lock that wipes data. It deletes everything on the device, and without the recovery key you can’t get back to old encrypted messages.
Found a weakness? Write to dev@pokecio.com. We’ll read it and get back to you.