Our license server enables the JWT JTI key for anti-replays, on our chomecast we see the device is requesting the license more than twice ( if it was twice I could look at maybe the first request is for the server certificate - but for chromecast this is not a thing it seems) which triggers the JTI anti replay. I see that the current version of the cast firmware uses shaka 3.2.0 and that there was a fix for this issue for Widevine ( or similar ) done for 3.0.2.
Wondering if someone as solved a similar issue on a chromecast where the player is requesting the license more than once ?
thanks
Expect the chromecast player to request license once.
Related
Basically, my question is the same than this topic but it's now 2018. So, how can I still have ECMAScript executed on my phone (to send geolocation position) even if it is asleep? We now have Open Web Apps and Progressive Web Apps (PWA) with service workers, even Apple is jumping in, I'm sure there are ways to do that.
While we can hope that things should've changed on this, unfortunately, it has not.
This article from Google on PWA GeoLocatoin API dated Jan-2018 says clearly that this API works "only while the page is open".
Why not available yet (in my opinion)? Thinking of users privacy, it makes sense. Think of tons of wep pages we visit and for how many we tend to five permission accidentally or we intend to give for a while(until we finish some transaction/booking). Currently there is no way for us to go and check on all location permissions that we've given to web sites in a browser, like we do for Native/Hybrid apps and having option to change it.
We can expect to have tracking option for PWA when it is installed to home screen, where native app like permission handling will be possible to user.
End of the story, we are not there yet!!
Alternate option: While you can use navigator.geolocation.watchPosition to track the user when he is actively using the app, You can complement your app with a separately installed (Native) Android service to update the users location to your back end server, till PWA supports naively.
I have a WINRT windows phone 8.1 app published on the store. The store dashboard shows a very mysterious crash event which occurs frequently. Its details are as follows.
Failure string name
EM_WATCHDOG_TIMEOUT_DEADA444_(MyAppName)_Timeout_expired:_event_type_=_SystemKeyPressed,_timeout_modifier_type_=_None,_server_task_currentState_=_Active,_targetState
I can understand that there is some sort of timeout expired in some calls. I can think of following places in app where that's likely
1) BackgroundUpload tasks - I am uploading files using background uploader
2) Web calls - App constantly makes web requests using HttpClient to a service
3) Suspension event - I am saving app persistence data while suspension
Has anyone faced similar crashes? Can anyone identify the exact cause for this?
(I know this question is quite vague but I can't provide more details)
I have a Windows Phone application running on a Windows Phone 8.1 device, and I am using Windows Push Notification Services (WNS) to deliver a push message to the device. Delivering push messages has worked for approximately 8 days, until I received WNS headers in the responses similar to these:
X-WNS-NOTIFICATIONSTATUS: dropped
X-WNS-STATUS: dropped
X-WNS-ERROR-DESCRIPTION: Blocked channel URL
X-WNS-MSG-ID: 2DC1361376C2827E
X-WNS-DEBUG-TRACE: DB5SCH101121937
I have not changed the push server implementation, nor the code on the Windows Phone device. There was literally no change in the build of either component. I went home at the end of a work day, and the next day, I ran a simple test only to be presented with that particular error. I have tried the following in an attempt to solve the problem:
Re-created the channel URL on the device.
Re-associated the existing Windows Phone application to the store.
Create a new Windows Phone application in Visual Studio (after association to the Store).
Re-created the Windows Phone application on the developer portal.
Used a different physical device.
Each without success. The documentation regarding WNS is sparse, there are no additional support channels that I am aware of, so I am stumped. What could be causing this particular error "Blocked channel URL", or, how do I solve it?
from your windows phone app you need to renew the url for the notification channel, because the url can be valid up to 15 days.
from the microsoft documentation:
"Request a channel each time the app launches. Channel URLs can expire and are not guaranteed to remain the same each time you request one. If the returned channel URL is different than the URL that you had been using, update your reference in your app server."
Edit:
see this link for reference https://msdn.microsoft.com/en-us/library/windows/apps/hh761462.aspx
I try to make correct authorization in Chrome App. I followed official tutorial, but I was not able to sign in - every try ended with redirection to settings page and communicate that
Account sign-in details are out of date. Sign in again
After signing in, I got redirection once again to setting page, and after a moment, the same situation happened.
I saw in chrome://identity-internals that token expiration date is set on 0 of Unix time, so it seems error.
I decided to try samples from Google Chrome Github. I installed the GDrive one and it worked fine - till the moment I deleted key from manifest, I found in documentation that this is kind of extension id. Without it, situation is identical to this with my own app. This happens in all samples with chrome.identity - without key, they are unusable, with key works fine.
Had anyone ever similar problem? Maybe this is connected to some kind of additional Origin in Cloud Console? I am not able to find any information about it. I use key from Web Application App, cause when I try to register Chrome Extension I always receive
Invalid appId for type CHROME_EXTENSION:
but in documentation of Chrome Apps is written that I should Web Aplication Keys.
Would be great if anyone could help. I use latest Dev Channel normal Chrome and Canary, same problem on both of them.
Right, the key needs to be there for the API to work. See http://developer.chrome.com/apps/app_identity.html for all the details.
I am trying to build an extension that would notify a user when new version of Chrome is available.
I tried to inspect network traffic when Chrome is checking for an update and it is sending a request to http://74.125.95.113/service/update2?w=3:{long_encoded_string} page that returns XML with information I need:
<?xml version="1.0" encoding="UTF-8"?>
<gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod">
<daystart elapsed_seconds="31272"/>
<app appid="{8A69D345-D564-463C-AFF1-A69D9E530F96}" status="ok">
<updatecheck status="noupdate"/>
<ping status="ok"/>
</app>
</gupdate>
Besides sending {long_encoded_string} as URL parameter it is also sending some encoded cookie.
Maybe someone familiar with Chrome build process can shed some light on those encoded strings and how to build them? Maybe there is another easier way (I have a feeling that string encoding is a dead end for me)?
Google Chrome uses omaha to do updates to clients. The protocol is described here: http://omaha.googlecode.com/svn/wiki/cup.html. One thing you have to notice is that Google Chrome automatically downloads the update to your computer and then notifies (via icon on the tool menu). Unless you force check by opening the about dialog (in Windows).
As you have noticed, the Chrome GUID is {8A69D345-D564-463c-AFF1-A69D9E530F96}
The best way to see how Google Chrome is updating is to check the source code which is public. Google just ifdefs their version of Chrome in Chromium.
Google Chrome Code
The base class where all the updates happen is in UpgradeDetector, it basically checks for an upgrade every 1 hour for the dev channel and once a day for all the other channels and builds (stable / beta). The Chromium way to do a scheduled events is through Tasks, in this case it is caleld a DetectUpgradeTask which checks for a specific BrowserDistribution::GetSpecificDistribution. There are many browser distributions, for Windows it is called GoogleChromeDistribution which is in charge to figure out what the version that needs to be update..
So why am I saying all this, Google Chrome is just querying registry settings and local files to figure out if a new update exists. The the UpgradeDetector just compares the distributions if they are the same. The implies that Omaha does the whole update mechanism. And the best part to figure out what omaha does is to look at their omaha update protocol.
The Omaha Protocol
From quickly glancing at the protocol, the approach your taking is the correct one, but you have to figure out the public key. In this case, the w, which differs for every request. You can read more about this in the "Protocol observations" in the omaha update protocol. It does this to do a securely check for download updates and they do this to protect the communication. They want the connection that checks for updates to be authentic and fresh so an attacker cannot replace or modify the message nor trick the client to upgrading a vulnerable version.
So what now
It isn't just a simple request to the server to do an update check. The Omaha client protocol provides an alternative to SSL for update checks and does client-server requests to see if its a valid connection. They are doing all this to protect the communication as explained before.
Unfortunately I don't think there is a "Chrome Extension" HTML'sh way to do this unless you implement that handshake yourself using NPAPI. Don't take my word for granted, I might be totally wrong :) Unless you can do the handshake all through XHR requests.
Since you want to check if Chrome has been updated and not installed, you have to verify that a new distribution has been downloaded as explained above in the code GoogleChromeDistribution which definitely requires NPAPI to read the registry.