Saint FortiClient, Who Signed the Key With His Own Name

Patron of keys written into code, passwords that look like the company name, and apps that keep secrets under the doormat.

Life

On 2 February 2015 CVE-2015-1453, born of a Security-Assessment.com advisory published in late January, made official a small naivety in FortiClient 5.2.3 for Android. To encrypt the passwords and other data saved in its preferences, the app used a fixed key, identical on every phone: the vendor's own name in alternating upper and lower case, with an exclamation mark and the word "Android". Anyone who found the key in the code could decrypt everyone's data.

Prayer

O Saint FortiClient, who hid the key where anyone could read it, teach us to keep secrets in the system keychain and not in the code. Amen.

How to celebrate

Celebrated by updating FortiClient and leaving encryption to the Android Keystore, which can generate a different key for every phone all by itself.