guardianproject / ripple Goto Github PK

I came here from Aegis - authenticator app has a setting to be locked on a trigger like "Ripple". I'm surprised to see so little activity in this repo. Is the project "finished"? I'd like to trust it, it would be reassuring to know if it hasn't succumbed to "bit rot" yet.

The link to the website in the readme is broken (bad TLS certificate + sends to a login page)

I'm using the Android App, and I'm satisfied by the simplicity.

What I'd love to see, is the option of locking the app via Fingerprint or Passphrase. It would definitely be possible for someone to open the app and tap the trigger.

If the owner hasn't got the necessary precautions like a backup, then something bad can happen.

Problem
Android Studio 3.1.2 doesn't recognize values-zh-Hans folder when building app and give me the error:

/Ripple/app/src/main/res/values-zh-Hans: Error: Invalid resource directory name

Solution
Replace values-zh-Hans with values-zh.
From my understanding of simplified / traditional Chinese language variations this is correct replacement.
More on the problem
This guy probably addressed issue the best
https://gist.github.com/amake/0ac7724681ac1c178c6f95a5b09f03ce#new-locales-vs-old-locales-chinese

I'll be happy to fix it in PR

If I'm not mistaken, when we start the procedure a 5 seconds countdown starts before the action occurs. If we tap the screen while on countdown, the procedure stops.

A faster way of action without the countdown should be implemented to instantly act, if possible, for situations where every second counts.

Thank you for your project.

Hello people, first of all I wanted to say thanks for creating such a wonderful application, please don't stop.

Second of all, if the software is not dead, is there a list of supported applications? Also, what are the limits of Ripple? For example, can uninstall an app? Delete its content? What?

It should be possible to turn off the device automatically after all other actions have finished. Then the device encryption will protect the device.

I want to address one particular threat model that doesn't seem to have been brought up here. What if an attacker snatches the device from you and you never have enough time to physically trigger Ripple? Shouldn't there be a contingency for that situation? I'm thinking there should always be a covert, secondary, two-step trigger that's initially activated by detection of rapid device acceleration. Then the user could have the opportunity to shout a trigger phrase like "Sic semper tyrannis", "Dracarys", etc. to initiate panic lockdown. Of course, this doesn't solve the situation where the attacker incapacitates you first, but it is another potential tool in your privacy arsenal. The more paranoid can probably just set a dead-man's timeout in that case.

Many people insist on using biometrics for unlocking their phones. This is not a good security practice because it can be used to unlock your phone by an adversary. Nevertheless, many people insist on continuing to use it. For those who do, it would be good to have the panic mode disable biometrics, and revert to the pattern/password unlock method to protect them.

I think it's better if the app also removes any trace of it having been installed on the phone, as far as possible

Possible Ideas:

• Just hide the app

• Export config "somewhere" where nobody would look and encrypt it with device key, then remove ripple itself via root. (So when ripple is reinstalled it just picks up the config by itself)

• Disable app via root

The Transifex link in the README no longer works

Have installed the F-Droid Privileged Extension and the added feature to uninstall selected or all apps is neat.
I would love to see a remote trigger via lets say sms to remotely fire the fdroid ripple respond in the case of a lost device as an antitheft kinda feature
Thanks for the great app and keep up

By tapping "Edit" next to the "F-Droid" icon, and then unselecting/selecting the checkbox, can see the app password.
Maybe the "Ripple" application needs to add a password after the trigger is activated.

Apps like Signal and Openkeychain will be hidden in the Ripple App but would not hide on the phone itself. So this application will be useless up to now.

I would like to activate Ripple from another application.

I have tried triggering both .CountDownActivity and .PanicActivity via Activity Manager, but it throws an exception:

$ adb shell am start -n "info.guardianproject.ripple/.CountDownActivity"

Starting: Intent { cmp=info.guardianproject.ripple/.CountDownActivity }
Security exception: Permission Denial: starting Intent { flg=0x10000000
cmp=info.guardianproject.ripple/.CountDownActivity } from null (pid=5461, uid=2000)
not exported from uid 10154

Is this by design? What are the security implications of allowing this? It would be great for other processes to be able to use Ripple as a sort of panic signal router, where the list of receiving applications is managed. In various automation solutions it could mean "if X happens, send panic signal to [apps] via Ripple", which could be very powerful.

Maybe it could be an opt-in option to allow this?

If an app is setup to as "Device Administrator" it apparently can lock somethings down in the OS. It could make sense to make Ripple provide this functionality. At the very least, it seems there should be some Panic Trigger app that does this.

Here's one proprietary example:
https://play.google.com/store/apps/details?id=com.radefffactory.lockdown

Hi,

Thanks for this project, it's a really good idea to help privacy minded people.
I discovered Ripple thanks to Briar which has a setting regarding Panic Button Apps and directly redirects to your app in Play Store.

I managed to set everything up fine. Once I triggered Ripple F-Droid correctly hides itself (using a fake calculator app to recover) but Briar, Signal and Newpipe aren't doing anything. They are still in my drawer and there's still shortcuts in my launcher.

Is it a problem on their end or on Ripple's ?

I'm on Android 11 and I've already seen a lot of app not working correctly because of android 11 upgrade. Could it be the culprit ?

Thanks a lot for any input.