Database Info

Play Store vulnerability.

I recently was thinking about something, I decided to test it out.
On the Play Store app, you can choose to add a pin number, and make this pin be required to make purchases.
This is a good idea, as we don't want anyone charging our credit cards or carrier bills if our device gets lost/stolen.
However, there is a flaw in this. The aforementioned pin number is stored locally on the device, whilst the credit card info is connected to your google account, and obviously your carrier billing options are stored online.
All someone has to do to be able to make purchases on a supposed secure play store is go to Settings>Applications>All>Google Play Store and click clear data. No more pin.
trter10 said:
its also stored in plain text! /data/data/com.android.vending/shared_prefs/finsky.xml
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Click to expand...
Click to collapse
The fix to this would obviously be that google have the pin be connected to your google account, instead of stored locally on the device.
Reported to Google. PLEASE STAR THE ISSUE! Will help it get to the people that can fix the problem!
http://code.google.com/p/android/issues/detail?id=38025&thanks=38025&ts=1349027733

Good find man! Definitely opens up my eyes, as my little brother has a phone with my google account on it, because of all the apps I've bought-en, and I enabled the pin feature on it.

Wow... way to drop the ball on that one google!!!

Yeah. Not sure they've ever thought of it or not.
Posted by Mr. Z's HP Touchpad.

What?I haven't made any purchases yet, but my friends come to me on some days and they could buy paid apps.This must be fixed soon.

I notice this a lot when I update my ROM. Because it doesn't come packaged with gapps (well it wouldn't, it's illegal to do that), the data gets cleared when you reinstall the play store, thus no more pin. As I update daily, I never have the pin for more than one day, which is a major security flaw IMO
Sent from my Galaxy Nexus using Tapatalk 2

Indeed Maybe Google needs to be informed of this!
!DH eriseD ym morf dneS

You should DEFINITELY post that issue on the Google Support page!
Kinda like this one, http://code.google.com/p/android/issues/detail?id=27431

Reported to Google:
http://code.google.com/p/android/issues/detail?id=38025&thanks=38025&ts=1349027733

wow how dumb of google

"STAR" THE ISSUE!
The more stars it gets, the more likely Google will see it!!!

zanderman112 said:
I recently was thinking about something, I decided to test it out.
On the Play Store app, you can choose to add a pin number, and make this pin be required to make purchases.
This is a good idea, as we don't want anyone charging our credit cards or carrier bills if our device gets lost/stolen.
However, there is a flaw in this. The aforementioned pin number is stored locally on the device, whilst the credit card info is connected to your google account, and obviously your carrier billing options are stored online.
All someone has to do to be able to make purchases on a supposed secure play store is go to Settings>Applications>All>Google Play Store and click clear data. No more pin.
The fix to this would obviously be that google have the pin be connected to your google account, instead of stored locally on the device.
Reported to Google:
http://code.google.com/p/android/issues/detail?id=38025&thanks=38025&ts=1349027733
Click to expand...
Click to collapse
its also stored in plain text! /data/data/com.android.vending/shared_prefs/finsky.xml

trter10 said:
its also stored in plain text! /data/data/com.android.vending/shared_prefs/finsky.xml
Click to expand...
Click to collapse
I was just coming to post this same thing... glad somebody else seen this also...

flastnoles11 said:
I was just coming to post this same thing... glad somebody else seen this also...
Click to expand...
Click to collapse
Thanks guys, added that in a comment on the google code page.

Actually, I believe that function is more of a "Child Lock". The screen lock/wipe is supposedly what prevents stolen phones from being used. In most cases, someone that usually knows your password (Of course, adb enabled phones can have their screen lock disabled). That's usually your kids that use your phone for games, watching videos, etc. That's what the pin is for - blocking them from downloading paid stuff without your knowledge. I suppose Google doesn't think that they would be the ones who will be hacking your phone, and of course, not be the ones who steal your phone.

Just added a link to the google support issue page in a few of my newer videos, and in a few of my most popular videos!

We need to get this big, it needs as many people as possible to star it. We really need to get this on the portal and everywhere else
Sent from my ARCHOS 80G9 using Tapatalk 2
---------- Post added at 04:45 PM ---------- Previous post was at 04:35 PM ----------
Tweeted to xda, android, android police, androidauth, retweet this
https://twitter.com/Quinny898/status/253157268806328320
Sent from my ARCHOS 80G9 using Tapatalk 2

Seems it'll get a news story soon
Sent from my Galaxy Nexus using Tapatalk 2

Quinny899 said:
Seems it'll get a news story soon
View attachment 1370476
Sent from my Galaxy Nexus using Tapatalk 2
Click to expand...
Click to collapse
Thanks, but PoorCollegeGuy already wrote it up. I send him stuff as soon as I see it, or in this case, when I wrote it. Article is already on the Portal.
Have yet to see other sites pick it up however.
Posted by Mr. Z's Galaxy S3.

I wouldn't really call this news.
http://www.redmondpie.com/clearing-...rom-settings-removes-pin-protection-security/

The AT&T LG-G4 Lounge

The LG-G4 Bar and Grill
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
On Tap:
Off topic, this stik'n thread ain't got some off topic... it should all be off topic
[*]Cell phones? Of course:good:
[*]
Incoming Updates (OTA)
[*]Battery, in comparison to (name the device). How do you feel about battery life?
[*]Your favorite song.
[*]ROMs/Kernels/Themes we all want to see
[*]The camera... Amazing?
[*]Camera issues
[*]Have you previously owned other LG-G series devices?
[*]Pizza & Beer
[*]Lets help keep requests and ROM suggestions out of development threads. Post it here, if you need to say it!
[*]Help those looking answers
[*]Basically anything dealing with the LG-G4 :good:
[*]Homescreen pics

The AT&T LG-G4 Ⓛⓞⓤⓝⓖⓔ
So I just got a notification about an update for my AT&T H810. it says its a 149.51 MB download. Lets hope this one doesn't auto update on us like the last one did.

What version is now?

olivercervera said:
What version is now?
Click to expand...
Click to collapse
I haven't updated yet. Still a little reluctant to do it since we don't have root yet. Don't want this to be the patch. :/
Edit: Nevermind, update started on its own. FML.. lets see what happens next..

Let us know for sure. Was there a change log?

bustervic said:
Let us know for sure. Was there a change log?
Click to expand...
Click to collapse
No, no change log. Also checked on AT&T's software update site and they don't have this new update listed yet. All they have is the one we got last month that updated AT&T's address book app.
Phone is rebooting now..

I don't see anything different right off the bat, but will report back if anything has changed/improved.

Follow the instructions here to block updates.
The thread is continually updated as users discover new files to block.

phineous said:
Try this to block updates.
Basically use debloater to block LGDMSClient.apk.
Don't get too excited about the mention of recovery mode in that post, it doesn't work on AT&T.
Click to expand...
Click to collapse
Too late for me now but, thanks for linking this for other users. :good:

I'm curious about touchscreen and camera tweaks. That said I'm sure 150mb update has more than that.

uly609 said:
I don't see anything different right off the bat, but will report back if anything has changed/improved.
Click to expand...
Click to collapse
Interesting, thats the same old version as the last update, where verizon got a new kernel.

Installing now. Let's see what is in this!

any news on touchscreen?

Just insatalled going to uninstall SGS screenbooster to see if there is a fix for the touchscreen. Will report back

Just wondering, did it skip from software version H81010e to H81010g or did I miss an update?
Is LG or AT&T posting change logs anywhere?
Is there any tool that will let us pull version data from the APKs so we can see what's updated?
I've been out of the scene for awhile (first new phone since the One X) so please pardon me if the answers to my questions are common knowledge.

im on 10e, and tried to manual check for 10g, says i'm up to date... can't check again for 24hrs.

phineous said:
Just wondering, did it skip from software version H81010e to H81010g or did I miss an update?
Is LG or AT&T posting change logs anywhere?
Click to expand...
Click to collapse
Yes, the software went from "e" to "g" with one update. It is normal during software development to not release every point release.
Change logs do get posted, but they are not very good and they are not timely (it may take a few days).

Wonder if I will get this since I use my h810 on tmo's network. I checked for update but it didn't find anything.

theblizzard2010 said:
im on 10e, and tried to manual check for 10g, says i'm up to date... can't check again for 24hrs.
Click to expand...
Click to collapse
You can check for updates again by simply changing your date

Verizons 11A update had performance and touchscreen updates. Definitely feels faster and touchscreen feels more responsive.
Although my battery is at 30% where normally this time of the day is at 70%. And also my Qi Charger had my phone rebooting this morning.

[ASK/OPINION] What to do about Xiaomi's decision on disabling UBL service?

Sorry if I posted this thread in the wrong place, but after searching here and there, the only place appropriate for my thread seems like in here. If I posted in the wrong place feel free to delete my thread or to move my thread to the right sub-forum. Sorry if this feels like I'm ranting or complaining, but this issue of mine just seems so cruel, evil, and unfair, especially done by such a big brand like Xiaomi.
So here's the deal, I bought a Xiaomi Redmi 5A (2GB RAM and 16GB's of storage) in mid of January. I bought the 5A because it had great specs even with it's low price and it's because my current daily driver can't handle the latest of what Android offers (I was using an ASUS Zenfone 5 with an Intel Chipset, very fast battery drainage, low compatibility with latest apps, and very poor signal reception plus dying support on XDA).
I bought my 5A online from a Official Store, but it was manufactured in my country (Indonesia) that was under a certain brand of smartphone warranties (TAM). I checked the device via Mi-Verify and the results showed up seeing my 5A is an official device supported by Xiaomi.
When the device was in my hands I proceeded to try to unlock it's bootloader, so I can gain root access and start restoring right away every Titanium Backup backup I had so I can use the 5A as my daily driver. I logged in to my Mi-Account and because my account had already been approved of Mi bootloader unlocking since 2016. I thought everything would turn out smooth, I expected that I had to wait for 72 hours or something (which I didn't mind about and was willing to patiently wait for). I proceeded to enable Developer Settings (in which is required to be able to bind my account to the device and unlock it using Mi-Unlock Status). I turned on USB debug & OEM unlock then I proceeded to get permission (bind Mi-Account) from Mi-Unlock status. This is were things went downhill.
First, it showed me an error code 10008 (in which could be fixed by using a Chinese based VPN server), then after using a VPN, it showed me another error code which is now my current nightmare: code 86023 hardwareId abnormal (<- originally Chinese fonts which I translated via google translate). I started searching for guides here and there to fix this issue with no luck at all. I tried every guide out there and even destroyed my warranty in process (I had to open the back case and use the test point methods) because I was followed a guide that said I had to flash via QFIL/Mi-Flash a China Developers ROM to be able to unlock my bootloader (which didn't change a thing, it still failed to unlock and still showed those 2 error codes: 10008 & 86023).
I even posted a thread in MIUI forums about error code 86023 in the complaints/advice sub-forum (in which now has the highest views and replies), and was surprised to see that I wasn't the only one with this UBL issue. It affected lots of Xiaomi devices that were manufactured or distributed in the near end of 2017 and early 2018 (especially Asia-Pacific devices). I faced a dead end and was hoping that it'll get fixed in a month.
After waiting for a month or more, it didn't get fixed at all. The only thing that was fixed was error code 10008 (Now it doesn't require a bypass via VPN) but the error code 86023 persisted. I got totally frustrated and tried contacting customer service via online chat and via email. First I tried online chat, and they suggested me to go to a local authorized service center to ask for bootloader unlocking. When I arrived to one of those shops, I was surprised that they said that they don't accept UBL pleas, they say that the user has to do it by their own consent (which pissed me off because I told them my situation and they still refused to help me). Then I emailed my country's customer service ([email protected]). I had 2 sessions of replies in which first they told me that UBL has been disabled by Xiaomi because they fear my device would be vulnerable to virus attacks (SERIOUSLY!?). I told them that I understand the risks of UBL and asked for a better and decent explanation on why UBL has been disabled. Then I received this reply:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
"Kami mohon maaf atas kendala dan ketidaknyamanan yang Bapak Ezra alami. Terkait kendala yang terjadi, perihal kebijakan bahwa Unlock Bootloader sudah ditiadakan merupakan wewenang dari pihak Xiaomi Pusat yang berada di Cina."
This translates to:
"We are sorry for these issues and inconveniences that Mr. Ezra has experienced. Regarding to the problems that have occurred, the Unlock Bootloader policy has been removed and it is under the authority of Xiaomi's central headquarters that is in China."
After reading this, I was dumbfounded, totally dumbfounded. I nearly went ballistic. I was super pissed off and disappointed.
So from what I read, it seems like devices for my country, or maybe all of Asia Pacific has been totally locked out of UBL. So now I have no idea on how to unlock my Redmi 5A.
I did read UA of Xiaomi and found that they have total rights on removing a feature of some sort (read Xiaomi's User Agreement):
"The user accepts that in relation to business development, we may change, suspend, restrict, terminate or revoke the rights of our services at any time without notice;"
I understand this very much, but why did they have to terminate UBL? I thought Xiaomi supported developement and modding. But how did it come to this?
Please give me your opinions about this absurdness that Xiaomi has thrown to me and many other users out there.
Thanks.

Pixel 2 9.0 FRP bypass

I recently bought a pixel 2 XL for cheap on ebay, turns out it is FRP locked. I was looking for a bypass and they all seem to be patched. E.g. Talkback, maps, magnification. While digging I was able to get to the internet in a limited capacity. The google keyboard allows you to search for gifs and I was able open a tenor gif which had the a link to see more gifs which led me to a website. Ill link pictures. I was able to navigate from there to facebook and then to youtube and the rest of the internet by logging into facebook and messaging myself or posting links privately on my wall. What I could not do was launch other apps or download anything. Anyways this is what I've manage so far, hopefully someone can finish what I have started.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

Pics link
https://imgur.com/a/hoLNPwN

code9523 said:
FRP is not a solution to protect stolen phone from use as it is bypassable. There should be an option in google account to full dissable phone to prevent it even turn on.
Click to expand...
Click to collapse
open an issue for this on google's issue tracker and lets see what response you get.

Moderator Information: Some posts are removed. Please remember our rules while posting. Thanks.

Any Luck
I am on the same boat. Talkback 7.0

i have successfully bypass frp on pixel 2 xl android 9.

adna said:
i have successfully bypass frp on pixel 2 xl android 9.
Click to expand...
Click to collapse
That's kinda not helpful at all. The way it works is you post your method and anyone who accidentally locked their own device can unlock it. Naturally, this is not useful for blacklisted IMEIs in the US.

so sad to see no updates on this thread, I've had this stupid pixel for months now while my gfs phone continues to detoriate, and I'm really hoping someone discovers a new method soon. I don't trust the guy who posted that and then disappeared when he was essentially asked to prove it lol

Search YouTube: Android 9 FRP bypass.

kelarys said:
so sad to see no updates on this thread, I've had this stupid pixel for months now while my gfs phone continues to detoriate, and I'm really hoping someone discovers a new method soon. I don't trust the guy who posted that and then disappeared when he was essentially asked to prove it lol
Click to expand...
Click to collapse
The problem with any discussion about bypassing Google's Factory Reset Protection - even if it were possible - is that it is impossible to determine if we're helping people legitimately access their phone or if we're helping them take over an ill-gotten phone. That's why conversations around this topic always stall out. We don't want to go around accusing people and we also don't want to even inadvertently be party to theft.

computerslayer said:
The problem with any discussion about bypassing Google's Factory Reset Protection - even if it were possible - is that it is impossible to determine if we're helping people legitimately access their phone or if we're helping them take over an ill-gotten phone. That's why conversations around this topic always stall out. We don't want to go around accusing people and we also don't want to even inadvertently be party to theft.
Click to expand...
Click to collapse
We have to give benefit of the doubt. But I agree with you entirely.
Sent from my [device_name] using XDA-Developers Legacy app

I’m not able to find a true working frp bypass. I don’t get a search icons to bypass like all the videos show for android P. And the helo&feedback button doesn’t take you anywhere. So I’m guessing Verizon blocked it in the last patch

The only way to fix this is to send it back to the seller. Ask for a refund.

No news?

try this new video youtu.be/WS1RFEiFMM8

hakkuba said:
try this new video youtu.be/WS1RFEiFMM8
Click to expand...
Click to collapse
Thanks a bunch! This worked.

computerslayer said:
The problem with any discussion about bypassing Google's Factory Reset Protection - even if it were possible - is that it is impossible to determine if we're helping people legitimately access their phone or if we're helping them take over an ill-gotten phone. That's why conversations around this topic always stall out. We don't want to go around accusing people and we also don't want to even inadvertently be party to theft.
Click to expand...
Click to collapse
I just discovered a new way.I dont know if itll work but.....
https://forum.xda-developers.com/pixel-c/help/pixel-c-8-1-1-frp-bypass-t3879498

Factory Reset Protection is Annoying, Get Rid of it!!!
I purchased a Google Pixel 2 Certified Refurbished on Amazon and I have this issue as well. If anyone has a solution I suggest they post it...party to theft or not, **** happens and I hate when device vendors install crap like this claiming it's to prevent theft....it's to boost sales, period. Fortunately I can get a refund or replacement but its a bleeping waist of time having to mail in my phone and wait for another phone be sent to me.
IMO this factory reset protection hurts more legitimate users than it protects. It create brick/useless devices that is a waist of resources just so companies can make more $ . . . If you lose your phone, track it down, get insurance and/or consider it a loss. If I irreversibly lost my phone I would not harbor some BS attachment to it...Ideally I would like it returned but alternatively I'd prefer someone else make use of it than create more waist.
Please search Change dot org for my petition for Google to remove FRP

I got a Pixel 2 XL with Android 10. How can i bypass the FRP ?

General Android 12 "RETAIL* ver

Notice Android 12 under the *RETAIL" folder. Link below. What is RETAIL? Who is is for. I'm guessing it's safe to try?
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors.lolinet.com

It means that Android 12 is already being gradually implemented for our Moto G100 XT-2125. Now it remains to wait for it to reach each specific model.

hawki said:
Notice Android 12 under the *RETAIL" folder. Link below. What is RETAIL? Who is is for. I'm guessing it's safe to try?
lolinet mirrors - firmware, software, iso etc.
lolinet mirrors - powered by h5ai
mirrors.lolinet.com
Click to expand...
Click to collapse
It means that Android 12 is already being gradually implemented for our Moto G100 XT-2125. Now it remains to wait for it to reach each specific model.

From what I can tell, there are literally only 2 iteration's of this phone, and even then, the hardware differences between the 2 phone has something to do with GPS, it is negligible. So, therefore IMHO, firmware should be fairly universal except for bloat - any thoughts?
Also, anyone specificlly know what "RETAIL" stands for? is there a specific region?

hawki said:
From what I can tell, there are literally only 2 iteration's of this phone, and even then, the hardware differences between the 2 phone has something to do with GPS, it is negligible. So, therefore IMHO, firmware should be fairly universal except for bloat - any thoughts?
Also, anyone specificlly know what "RETAIL" stands for? is there a specific region?
Click to expand...
Click to collapse
RETAIL is one of the software channel like RETUS(America) , RETBR(Brazil), RETCN(China), for RETAIL it is probably stand for rest of europe SKU(picture 1).
To know which software channel you are, you can go to about phone(picture 2)
YOU CAN'T FLUSH OTHER CHANNELS FIRMWARE WITHOUT BOOTLOADER UNLOCK!!!!!!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

KuwaLee said:
RETAIL is one of the software channel like RETUS(America) , RETBR(Brazil), RETCN(China), for RETAIL it is probably stand for rest of europe SKU(picture 1).
To know which software channel you are, you can go to about phone(picture 2)
YOU CAN'T FLUSH OTHER CHANNELS FIRMWARE WITHOUT BOOTLOADER UNLOCK!!!!!!
View attachment 5600085
View attachment 5600093
Click to expand...
Click to collapse
Update: I got the answer

RETAIL - boots as cninese - FYI and I am unable to change the boot language to english, so of no use to me

I installed it but 5g didn't work. It shows 4g+
Also, there's an option to disable the sim. But if you do so, couldn't find a way to reenable it other than taking it out and putting back again.
However, everything else seemed very good.

retail global version installed on my moto edge s 5G, chinese version, a chinese version A12 has not arrived yet, waiting to return to my stock rom

hawki said:
From what I can tell, there are literally only 2 iteration's of this phone, and even then, the hardware differences between the 2 phone has something to do with GPS, it is negligible. So, therefore IMHO, firmware should be fairly universal except for bloat - any thoughts?
Also, anyone specificlly know what "RETAIL" stands for? is there a specific region?
Click to expand...
Click to collapse
I'm from the United States my Moto g100 model number is xt2125-4 code name Nio and the firmware version I have is North American retail. The g100 version I have doesn't have any bloatware because the only way to get this phone is to buy it directly from Motorola USA. And that's what retail means it means you bought it directly from Motorola or the company and not a cell phone carrier. My model only has 8 gigs of RAM 128 gigs of memory has NFC a dedicated Google Assistant button and a fingerprint scanner on the side. Here in America it's kind of a unique phone. Because it's the only phone that's designed and sold on the American market that has a dual SIM tray. And you have the option instead of using a second SIM card I can put in an SD card
hawki said:
From what I can tell, there are literally only 2 iteration's of this phone, and even then, the hardware differences between the 2 phone has something to do with GPS, it is negligible. So, therefore IMHO, firmware should be fairly universal except for bloat - any thoughts?
Also, anyone specificlly know what "RETAIL" stands for? is there a specific region?
Click to expand...
Click to collapse
I'm from United States yeah retail means that you bought it directly from the manufacturer and not a cell phone carrier. So there's absolutely no bloatware