Our turnkey solution enable the deployment of large scale purchase incentive programs using the Visa payment network

Hello Network

is the 18-year-old Spanish co-founder and CEO of Hello, a decentralized storage network, who is betting on the future of blockchain and AI.  In this interview, Alvaro told me about his foray into the blockchain world and his ambition to become the Larry Page and Sergey Brin of web3. Read on! Alvaro Pintado Alvaro, Can you tell us how your journey to blockchain and decentralization began? I’ve always had the humanly common and innate desire of changing the world, and the main difference is that I am determined to materialize that desire into reality. Expressing this idea may appear quite simple, yet the execution thereof presents a distinct challenge. That is why I made a choice to meticulously analyze all the potential components within my grasp, aiming to see what is the greatest thing that can be done, because it is all about impact, right, and about what is the thing in essence that inherently has the capacity to wield the most significant influence on humans worldwide. As one of my favorite quotes says: "People will forget what you said, people will forget what you did, but people will never forget how you made them feel." Through an exhaustive examination of concepts and elements, delving into the crux of the matter, I achieved success. The conclusion I arrived at is that the element or technology with the greatest influence and impact on the world is not , any particular company, or platform. It is, in fact, the internet protocol—the foundational framework that connects us all across the globe. social media Blockchain is just the start of this connectivity revolution that will eradicate the IP as we presently know it. It is at this juncture that my journey with decentralized systems commences. Can you provide an overview of Hello and its mission in the decentralized data storage space? Hello is what we call a truly decentralized ecosystem, and its mission is very clear: to establish itself as the decentralized Google. In other words, we want to be the Google of . web3 We firmly believe that the trajectory of the internet is moving towards a paradigm where efficiency, sustainability, and scalability will be essential pillars of the system, the obsolescence of conventional user authentication methods and centralized solutions such as usernames and passwords is evident, and it makes no sense that 3 or 4 private companies monopolize the majority of data transmission and storage all over the internet, that is not fair nor logic for the users in terms of pricing and ownership of their own data. So Hello’s mission is to democratize data storage and to give ownership to users over their own information, and furthermore, we are going to be the world’s biggest decentralized ecosystem in less than 4 years. As a company, we hold that there are 3 fundamentals of the future, and those are efficiency, sustainability, and optimization. The decentralized concept is one of the few that inherently possesses these 3 fundamentals, so this is why decentralization is the answer. How does Hello differentiate itself from traditional centralized data storage solutions? Hello Space, which is the first app of this ecosystem (a decentralized drop-box) embraces the concept of object storage. Unlike traditional file-based storage systems, object storage treats data as discrete units, known as objects, which are accompanied by for efficient organization and retrieval. This approach enables seamless scalability and optimal utilization of resources, ensuring that data can be easily accessed, modified, and distributed across the network. metadata One crucial distinction lies in ownership. In centralized storage solutions, data ownership typically resides with the service provider, granting them control over users' information. However, the whole Hello Ecosystem operates on a decentralized model, leveraging blockchain or distributed ledger technology. This means that data ownership is decentralized, giving users more control and autonomy over their own data. Instead of relying on a single entity, the data is distributed across a network of nodes, enhancing security and resilience. Moreover, Hello Space addresses the limitations of centralized solutions that rely on passwords for user authentication. These methods have become increasingly vulnerable to breaches and identity theft. In contrast, Hello Space implements advanced cryptographic techniques, such as public-key cryptography, to authenticate and secure user access. This ensures robust protection and reduces the risk of unauthorized access to data. We are challenging the status quo of a handful of private companies monopolizing the flow and storage of information. By operating on a decentralized model, we contribute to a more equitable distribution of data control. We are allowing users to participate in the network by contributing their own storage resources, enabling a peer-to-peer exchange of storage capacity, and incentivizing users to be active participants in the ecosystem. Can you explain the incentive model for participants in the Hello network? How do they contribute to the ecosystem? Sure, but before that, it is important to understand that in a decentralized peer-to-peer (P2P) storage network, the incentive model aims to motivate participants to contribute their storage resources and actively participate in the network's operations. This model revolves around rewarding participants for their contributions while ensuring the overall efficiency and sustainability of the network. One key aspect of this incentive model is the concept of resource sharing. Participants who contribute their storage capacity to the network are incentivized by receiving rewards or tokens in return. These tokens can represent a form of or utility within the network. The more storage space a participant contributes, and the longer they maintain their resources available, the greater their potential rewards. This approach encourages individuals to share their idle storage resources and helps create a robust and scalable storage infrastructure. cryptocurrency Additionally, participants may be rewarded for other valuable contributions to the network. For example, they can earn tokens for maintaining high uptime, providing reliable data retrieval services, or participating in consensus mechanisms for network governance. These incentives promote active engagement and ensure the network's health by fostering a cooperative ecosystem where participants are rewarded for their positive contributions. Basically, the incentive model in a decentralized P2P storage network aims to align the interests of participants with the network's goals. This is achieved by offering rewards for resource sharing and meaningful involvement; the model incentivizes collaboration, reliability, and long-term sustainability, ultimately enhancing the overall functionality and efficiency of the decentralized storage ecosystem. What are the scalability challenges that Hello Storage faces in achieving widespread adoption? The truth is that we’ll face several scalability challenges that will need to be overcome in order to achieve widespread adoption of our decentralized storage network. One of the primary challenges is maintaining network performance as the user base expands. As more users join the network and data storage demands increase, the network must efficiently handle the increased traffic and maintain low latency. Scaling the infrastructure to accommodate a growing number of users and their storage needs without compromising speed and reliability is essential. Another challenge is scaling the storage capacity of the network. As more participants contribute their storage resources, it becomes crucial to ensure that the available storage capacity scales proportionally to meet the growing demand. Efficiently managing and allocating storage resources while incentivizing participants to contribute their resources requires careful planning and robust mechanisms. Consensus mechanisms, such as , also pose scalability challenges. These mechanisms are essential for maintaining the integrity of the network, but as the network grows, scaling consensus becomes complex. Also, ensuring fast transaction processing times and maintaining consensus without compromising security and decentralization requires ongoing research and optimization. blockchain What are the future plans and roadmap for Hello? Are there any upcoming features or developments that users can look forward to? Good question. Due to our insatiable ambition, we will not merely stop at Hello Space. We aspire to surpass limitations and achieve the culmination of the web3 revolution. To accomplish this, we have planned the launch of Hello Network and Hello ID in approximately one year. The Hello Network will be based on our proprietary blockchain protocol, designed to accommodate even the smallest and least powerful devices, such as tablets and smartphones. Our objective is to gradually build a vast, highly stable, and resilient network where every user becomes a direct or indirect participant. Through this approach, we aim to gradually shift power from corporations to individuals, marking the beginning of a new era. On the other hand, Hello ID will serve as the definitive replacement for traditional methods of internet authentication. It will represent a unique and globally recognized digital identity, granting access to all applications, websites, and platforms across the web. Hello ID will be a cryptographically secured identity based on blockchain technology, empowering you to maintain control over all your assets without relying on any third-party entities. And so, with the launch of these two key parts of the ecosystem on the horizon, a profound transformation awaits us. We stand on the precipice of a new era fueled by our unwavering determination to push the boundaries of technological advancement. Together, let us redefine the rules, challenge the existing condition, and carve a path toward a future where the power rests firmly in the hands of individuals. With Hello, we embark on a quest to reshape the digital landscape, fostering a realm of boundless opportunities, unrivaled security, and true digital freedom. The revolution has begun, and you are at the vanguard. Embrace the dawn of a new era, for the possibilities are infinite, and the future is ours to shape.

"We Want To Be The Google of Web3": Hello Co-Founder Alvaro Pintado

DUBAI, UAE, February 8th, 2024/Chainwire/-- The Kinetex team is proud to announce an integration with 1inch. Despite the numerous decentralized exchanges (DEXes) that have emerged in the market, users still require assistance in locating the appropriate liquidity and the most effective trading routes for their crypto assets. This is unsurprising, as the DeFi industry and its services can be difficult to navigate, particularly for those with little or no experience, due to the abundance of platforms and tools available. Fortunately, the DeFi space can be made more user-friendly and accessible with solutions developed by the Kinetex team. Kinetex works to connect different chains more seamlessly for an effortless and favorable trading experience. Liquidity Aggregation is one such solution created to simplify the search for adequate liquidity across the blockchain ecosystem. It combines liquidity from hundreds of sources, including 1inch. According to Tigran Bolshoi, co-founder of Kinetex, 1inch stands out as one of the top liquidity aggregators in the DeFi market. Their API grants access to rates and liquidity across DeFi, enabling users to trade easily and quickly. Combined with Kinetex's advanced algorithms, this integration provides users with the best swap routes, whether on-chain or cross-chain. With nearly 12 million users and a trading volume of $420 billion, 1inch is currently among the crypto industry's trailblazers that are shaping the future of Web3. Therefore, working with them is a great honor for the Kinetex team and an exciting possibility to add even more liquidity to the efficient Liquidity Aggregation solution. Besides Liquidity Aggregation, the Kinetex team continues to explore and develop new cross-chain solutions that can help overcome even more problems often met in the cross-chain space. For instance, they are finishing the innovative Flash Trade, which will revolutionize how users engage with crypto. About Kinetex Network: Kinetex Network provides highly efficient cross-chain trading, enabling instant crypto asset transfers between networks through Zero-Knowledge proofs. Kinetex Network: | Website Kinetex dApp Contact Public Relations Jane Mayer Kinetex Network hello@kinetex.io This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here.

Kinetex to Integrate With 1inch to Boost Liquidity In Cross-Chain Swaps: What You Need to Know

The topic of article spinning and article spinning tools is a very controversial one — with several SEO ‘experts’ arguing in favor and others arguing against it. There are several reasons why one may consider spinning articles. Students do it almost all the time for assignments and essays. Some bloggers spin articles they’ve written so they can submit them to directories. Most freelance ‘writers’ (mind the quotes) you’d find on Fiverr and the likes do nothing but spin articles for their clients (well, you shouldn’t expect more for a $5-thousand-word article). Every person who spins articles does it for reasons best known to them. However, spinning articles for your business website? You don’t wanna go there. Now, you must understand that there’s a difference between content spinning and content repurposing. More on content repurposing later in this article. What Is Article Spinning (Or, Content Spinning)? “Article spinning,”  according to Wikipedia, “is a writing technique used in search engine optimization (SEO), and other applications, which creates what appears to be new content from what already exists. Content spinning works by replacing specific words, phrases, sentences, or even entire paragraphs with any number of alternate versions to provide a slightly different variation with each spin - also known as Rogeting.” Article spinning could be done using programmed spinners and can as well be done manually. One major problem with spinning articles with a spinning tool is the apparent misuse of words. Many of the spinning tools online simply swap words with synonyms without taking into account the context where the words were used. The issue with word misuse is most common with words that have variants in another part of speech — the word market can be a noun or verb, while well can be an adjective, interjection, or adverb. And with proper nouns, you might find Great Britain become Good Britain or the United States of America become the Unified States of America (or worse, the United condition of America). But in recent years, we’ve seen the development of smarter spinners. Particularly those that use Spintax: a portmanteau of spin and syntax. With these tools, spinning is at another level of depth. You can specify synonyms to be swapped for words in different contexts. Here, you do the heavy lifting, while the tool does the rewriting. But it can take you hours to define synonyms for different words in different contexts, depending on how long the original piece is. And such tools are often premium. Are There Any Benefits To Article Spinning? The most-touted benefits are speed and the ability to create hundreds of articles at a go — all from a single piece of content. But are those really “benefits?” The legibility problem has been mentioned earlier, but there’s more. When you spin an article in tens or hundreds and submit them for publication on multiple websites, there’s a high chance you won’t be able to get them on any major website. Instead, you’d have to go with forums, repositories, and low-quality network websites. Hello, have you heard of Google’s Penguin and Panda? They’re the main reasons why you should stay away from anyone offering “backlinks from 500 websites for a low price.” The reason why SEO is still being used to describe content spinning is that it was extremely effective in ranking in the past when Google ranked just about any website if it’s got enough link juice, but that’s no longer the case. Sure, backlinks are still very important in SEO, but Google expects you to do it white-hat, not black-hat. If Google notices anomalies in your backlink profile, you’re going straight into the oven. Toast. Bottom line: spinning another person’s content is only as bad as it can get. In Neil’s article, , Spun Content ranks #24. 50 Reasons Your Website Deserves to Be penalized by Google What Is Content Repurposing? Content repurposing is a relatively new term in content marketing, and it’s gaining popularity rather speedily. As defined by Brian Dean of Backlinko, “ (also known as “content recycling”) is the practice of reusing all or elements of existing content in order to expand that content’s reach. Repurposed content is typically transformed into a new format (for example, turning a blog post into an infographic).” Repurposing content From the comprehensive definition by Brian, it’s obvious that the reason for repurposing existing content is only to expand the original content’s reach. The content is yours, but you want fresh eyes on it. When you repurpose content, there are several options. You can make a blog post and turn it into a podcast. If it’s long enough, make it into an ebook. You can make a video interview, then turn it into a podcast, publish the script as a blog post, make it into an infographic, publish the script on LinkedIn, etc. With content repurposing, you’re not spinning an article to submit it as a guest blogging topic or for publishing in directories. You can, of course, publish it on platforms that accept already-published works. Since it’s duplicate content, it’s not going to rank anyway. But if the platform has a good following, you could be in for some nice click-throughs. What About Article Rewriting (Rework and Repromote)? Article rewriting is altogether different from spinning and repurposing. Though it may be easily confused with spinning, article rewriting generally doesn’t follow the same process as spinning and repurposing. And it does not intend to make the article look like a unique brand new piece. That’s why it’s referred to as Rework and Repromoting in content marketing. However, a consumer looking for such services would call it content or article rewriting. As technology evolves and the human race advance in knowledge, several studies conducted in the past are being revisited to see whether they’re still true in modern times. This is especially true for ever-changing industries like health, technology, search engine optimization, among others. As new studies come up, old ones become obsolete, and so do the pieces centered on them. Because of this, it is important to review old content and make the necessary updates. Besides the reason above, if you feel the articles done for your business website are sub-par, you might want to get them rewritten. You may also need to rewrite your articles for SEO. Moreover, Google delights in ranking newer articles than older ones. better represents how articles lose freshness with time with the image below. Moz In “Evergreen Content: What It Is, Why You Need It and How to Create It,” Si Quan Ong of Ahrefs mentions how Benjamin Brendall of Process.st boosted traffic to a two-year-old post by up to 468% simply by updating the post. He did things like correcting spelling and grammar errors, changing certain phrases, updating the published date, etc. After the update, the post received a spike in traffic and moved to 3rd position for its target keyword. While article rewriting is good for SEO and boosting organic traffic, content repurposing is great for promotion on different platforms like social media. Article spinning, on the other hand, is something you should stay away from. The problem with most people offering article rewriting services is that they end up spinning the article — manually or automatically — and won’t make any valuable addition to the article. In the process, they might spin your focus keyphrase along with the other parts of the article. And the worst-case scenario, they’d spin the entire article out of focus. The point of rewriting older articles is updating them to reflect the latest developments in the industry. Not only to reword and rephrase. : At the time of writing this article, I am not in any way affiliated with the businesses linked to in this piece, except my website which was linked to once. Also published on: Disclosure https://www.linkedin.com/pulse/whats-difference-between-article-spinning-content-repurposing-olu

How to Differentiate Between Article Spinning and Content Repurposing

My company, CriticalBlue, provides a remote mobile app authentication service called . An Approov SDK is provided as a drop-in library to native iOS and Android app developers. Approov With many of our customers using or experimenting with React Native, I wanted to provide a convenient Javascript module which exposes the native Approov SDK functionality to React Native developers. Overall, creating my first React Native native module was surprisingly straightforward. All code for my initial proof of concept is available in a . github repository This story describes bridging to iOS native modules. For the same example targeting Android, see . First experiences with React Native: bridging an Android native module for app authentication React Native Bridge For React Native, Facebook provides a solid which goes over the basics, including how to set up an application and how the underlying UI components differ from the usual React web elements. getting started guide from React Made Native Easy Architecturally, there are two important threads running in each React Native application — one a main UI thread and the other running a Javascript VM. The two threads interact through a bridge whose communication is asynchronous, serialized, and batched, decoupling the two systems as much as possible. While the bulk of the React Native app is described in React and runs on the Javascript VM, the UI is rendered using the native platform’s UI elements, and actions which alter the app’s UI are passed as messages through the bridge from the VM to the app’s main UI thread. System functionality and libraries developed for the native device environment can be exposed to the Javascript VM using React Native’s native module interface and accessed through the React Native bridge. Approov Native SDK The Approov SDK is a drop-in native iOS or Android library. It interfaces with the cloud-based Approov authentication service which validates that the app is genuine, untampered, and not a bot. An app integrity token is returned from the authentication service, and that token is sent with each API call to ensure that the back-end API service is dealing with a known and genuine front-end request. The basic operation we will expose in our native module proof of concept is , an asynchronous operation in the native SDK. fetchApproovToken() Approov-protected API call Before each back-end API call requiring app authentication, the client app makes a fetch token request. If a fresh token is needed, the SDK makes a remote attestation request, and the attestation service cryptographically authenticates the app and responds with an app integrity token. The token has a short lifetime and is signed by a secret known only to the Approov service and the app’s back-end service. No secret is stored in the app, and in fact the app does not know whether the returned token is valid or not. The app simply adds the integrity token to the back-end API call, and the back-end server validates that the token has not expired and is properly signed before processing the request. Approov Demo Service Approov offers a which provides demonstration iOS and Android SDKs and a back-end service with two endpoints: downloadable demo , which provides a publicly accessible test point. https://demo-server.approovr.io/hello , which provides a random shape only if the request contains a valid integrity token. https://demo-server.approovr.io/shapes We’ll use the iOS SDK with the back-end service to demonstrate a simple React Native app using Approov. For the Android version of this example, see . First experiences with React Native: bridging an Android native module for app authentication Saying Hello I started my React Native project using create-react-native-app (CRNA). Follow the to setup your React Native environment and then: CRNA installation instructions $ create-react-native-app rndemo I will be adding native code to the app, so go ahead and eject now from create-react-native-app: $ cd rndemo$ yarn eject... Ejecting is permanent! Please be careful with your selection. ? How would you like to eject from create-react-native-app? React Native: I’d like a regular React Native project.We have a couple of questions to ask you about how you’d like to name your app:? What should your app appear as on a user’s home screen? RN Demo? What should your Android Studio and Xcode projects be called? rndemo Wrote to app.json, please update it manually in the future.Generating the iOS folder.Generating the Android folder.... Select a regular React Native project and name it as you wish. The iOS and Android projects are generated, and you will need and/or build environments installed. Native code will be added to our native iOS project later on. Xcode Android Studio We will experiment with a very simple proof of concept app that will use the demo server hello endpoint to validate our network connectivity. React Native implements the for networking. We combine the connection check, UI rendering, and styling all in the file: fetch API App.js The top-level App component is registered in the file. index.js The main view is rendered by a stateless view component which displays a choice of image and a status message: I am using iOS for these examples, but this works similarly on Android. Fire up an iOS simulator (you may need to launch Xcode for this). In the directory, launch the app: rndemo $ cd rndemo$ yarn run ios You should see a screen like this: Push the button and you should see a connected message if everything went okay: Test Hello This validates network communication between our React Native app and the demo server. To run on an actual iPhone, connect the iPhone to your Mac. In Xcode, open the React Native iOS project, select the iPhone as your target and run the application. To test for no connection, if running on the simulator, disable your Mac’s WiFi or networking and push the button. If running on a phone, set airplane mode and then push the button. Test Hello Test Hello The Approov Native Module The Approov demo package includes a README, the iOS and Android Approov demo libraries, sample clients, and app registration tools. Download the , and save the app registration token which is included in your download email. demo package The Approov SDK includes the native code we want to expose to React Native. It must be included in the iOS or Android native projects which were generated when we ejected the create-react-native-app. For iOS, this project is located at . Add the Approov SDK framework into the iOS project by following these from the . rndemo/ios instructions Approov docs The iOS Approov SDK currently does not support bitcode, so you should set to in your Xcode project settings. Build Settings -> Build Options -> Enable Bitcode No In iOS, a native module is an Objective-C class that implements the protocol. Our example will mix Objective-C and Swift to register and implement the bridge to native code. RCTBridgeModule We’ll start by creating the bridge class in Swift with a call which wraps the asynchronous native call and settles a promise when the token fetch completes. Approov fetchApproovToken() fetchApproovToken() In the call, the promise is settled by calling the resolve or the reject . Our implementation simply resolves with the fetched token if successful or a sentinel on failure. Both closure blocks are marked with attributes to indicate that they may complete after the call completes. modifiers are used to export the class and functions to the Objective-C runtime. fetchApproovToken() RCTPromiseResolveBlock RCTPromiseRejectBlock NO_TOKEN @escaping fetchApproovToken() @objc The Objective-C implementation connects the Objective-C exposed Swift class to the React Native bridge. The macro registers the class, and the macro exposes the call. RCT_EXTERN_MODULE() Approov RCT_EXTERN_METHOD() fetchApproovToken() Whenever you mix Swift and Objective-C in the same project, you need a bridging header to expose the Objective-C files to Swift. It must include the React Native bridge headers. On the Javascript side, the Approov native module will now be included in the imported from . In our implementation, returns a normal javascript promise: NativeModules react-native Approov.fetchApproovToken() Bridging the native and Javascript environments was a bit confusing when mixing Swift and Objective-C, but in the end it required only a small amount of code. Interceptors Many networking libraries, such as and tp, include the concept of an interceptor. Interceptors can be used to intercept network requests and responses and inject some additional processing. Axios OkHt When implementing natively with the Android SDK, most customers use interceptors to fetch an Approov token and add it to each API request’s headers, so we’ll want to fully implement this abstraction in our production module. For this simple example though, we’ll hardwire the interception in a call. fetchWithToken() In the method, when the native fetch token call completes, if the promise is resolved, we add the token to the input request headers and make a call with the augmented input request. When completed, the fetch returns a resolved promise holding the API server’s response. fetchWithToken() fetch() For convenience, we create an object from the object, adding a method which is actually the method, and then we export this as the module. Approov NativeModules.Approov fetch() fetchWithToken() Approov Getting Shapes Now we are ready to use the object for authentication. We add a method inside our which makes an call to authenticate and request a random shape value. Once the fetch completes, the component state updates, triggering a call which causes the to display an updated shape and status message. Approov getShape() App Approov.fetch(request) App render() ShapeView A button is added to the button bar to request new shapes. Get Shapes Everything looks good, but when we request a new shape, we see a failure with a 400 status code, suggesting there is a problem with the client request. Failure to fetch a shape The call fails because the integrity token added by Approov is invalid. Until our example app is properly registered with the Approov service, the call will always fail the authentication check. fetchWithToken() Command line registration tools are included in the demo download. To register the app, issue a registration request specifying the App’s IPA archive and the app registration token you saved from the demo download email. You can generate the IPA archive from the product inside Xcode. As a courtesy to other demo users, set your registration to expire after a few hours using the flag: rndemo.app -e $ cd <<approov-demo-package>>/registration-tools/Android/Mac/$ ./registration-a <<your-rndemo.ipa>>-t <registration-token>-e 2h Submitting data…Success: new app signature added to database. Once the app is registered and can be properly authenticated, pressing the button should return one of these shapes: Get Shapes Successfully fetching random shapes Man in the Middle Attacks The security of the communication channel is very important during API calls. If the channel is insecure, an API call could be intercepted and modified. An integrity token, although it has a short lifetime, could be observed in the insecure channel and used to make malicious API calls with impunity. Despite using HTTPS/TLS when making API requests, an attacker who controls both the network and the mobile device can easily setup a to steal and quickly reuse Approov tokens before they expire. Man in the Middle (MitM) attack To counter MitM attacks, mobile clients should use which checks that the certificate or public key presented by the back-end service is known specifically by the client app. Other certificates, though they might appear authentic, will be rejected by the client, and no API calls will be made. certificate or public key ‘pinning’ Implementing pinning in React Native is a bit complicated and will be described in a separate article and integrated into this example’s code repository. Going Further We’ve demonstrated a native module implementation in React Native with a hardwired interceptor successfully providing app authentication and API protection. A production quality native module implementation for React Native would generalize the interceptor functionality, add convenience configuration methods, and provide full MitM protection. For comparison, a similar already exists for and hybrid apps. Approov plugin library Cordova Ionic All code for this example is located on . github Thanks for reading! For more information on mobile API security, check out . www.approov.io I’d really appreciate it if you recommend this post (by clicking the 👏 button) so other people can find it.

First experiences with React Native: bridging an iOS native module for app authentication

Backstory Solving Problems I wanted a way to check on my house (mainly my dogs) while I was away. So, I did what any trendy person would do and bought an IP camera with pan and tilt, which was great. A quick sign-up to their proprietary app, and I could view live videos of my pups tearing apart my house from anywhere in the world. Somebody's Watching Me The camera happened to sit atop my computer desk, and I kept hearing a buzzing noise one day while working. After searching frantically for a brief moment I heard this noise, to my surprise, I saw it was my IP cam panning. I thought, hmm, that's odd... I'll turn it off and back on again, maybe a motor started going haywire. After its boot sequence, it seemed stable . pats self on back, you did it, buddy Color me surprised when I started hearing it again... I started wondering, have I been hacked? So I turn the camera to face the wall, and almost immediately, it pans until it's pointing back at me. Growing more concerned, I turned it again, and yet again, it panned until it again pointed at me. So, I found a nearby box, turned it upside down, and plopped it on the camera... now what'll it do? To my surprise, it was repeatedly panning and tilting, so I was left to believe it was someone accessing the camera and was trying to pan and tilt to figure out where the action was. Time To Don The Tin Hat Now, this is pretty scary, to realize firsthand that someone, unbeknownst to me, had access to manipulate my camera, which also had audio so they could also hear what was going on in my house. Could I have been wrong, and it was just a fluke, sure... but this really brought home the importance of securing my privacy over making my life easier by nonchalantly adding copious amounts of devices into my household. smart The Fix v1.0 - No Internet I decided to upgrade to a wired camera system with no internet access. My main focus was to eliminate any access to the cameras except when connected to my local network (my home WiFi). By doing this, I would no longer be able to see which dog tore the house apart unless I recorded a constant stream or, at the very least, movement and was able to review it later. This would require the cameras to each have an SD card or a central DVR that would record constant video. So now, I can view the camera footage, but only if I'm home or view the recordings after the fact. Sure, my DVR had the option of exposing the data to the internet for viewing while away from home, but it still required me to use their app or expose the port and hope that the native software on the DVR was secure enough not to hack. Unfortunately, many companies don't focus on security because they want to be first to market or release the latest features without putting the appropriate focus on security. I also recently implemented to give my CCTV station smart features since most CCTV setups are fairly lacking in the "smart" department. This was also a safety feature for my wife, who isn't as technically savvy, so she could simply ask to see the workshop camera and know that I'm safely making progress on my woodworking projects not losing any more fingertips (that's another story). HomeAssistant v2.0 - Zero Trust Access Fast-forward a few years from "the camera incident," and I've finished a degree in software engineering, and worked at a few companies as a software developer, so I started to have a much better understanding of networking and network security. It also doesn't hurt that I was graced with employment by my current employer , which is a leader in zero trust networks. NetFoundry Say hello to OpenZiti, which has a freely available and, even better, it's open source, so if you're handy with technology, you can implement your own zero trust network. With OpenZiti, I could grant myself access to my HomeAssistant server and feel confident that nobody else will have access to view my cameras without my explicit permission. overlay network There's a lot of debate and confusion surrounding the term "Zero Trust" since it's inherently ironic in that you have to trust some things, but the general idea is that you have a set of people or devices that you trust and only once you trust them, you grant them access to services. So, how does this differ from a VPN? A VPN grants access to a network, so if I were to use a VPN to provide access to my home cameras, the users would also have access to other services on my server or even other devices within my network. So, in my case, I only want to provide access to my HomeAssistant server, not the CNC software or 3D printer software I have hosted on the same device. How I Implemented My Own Zero Trust Network to Access HomeAssistant The Network Before Planning The Network To build the network, I need to know three things: Who is the client (the one who wants access) Who is the host (the one with the service I want to access) Where is my zero trust controller going to sit (usually some globally accessible location like a cloud server) The Client I am the one who wants to use my service, so I will be the client in this scenario. Though it's also important to think big picture, do I want more people to have access to this at some point? If I want others to access it, will I want to add the new client identities one by one or use an attribute? Using an attribute allows me to give access to any identity (user or device) by using a key identifier. I will eventually want to add my immediate family, so I'll use an attribute that defines my family; we'll call it . #berl.household.member Now, any identity I create in the future and assign this attribute (which I will assign to any person living in my household) will have access to view my cameras. This is neat because it doesn't have to be my family, just any person or device residing at my house as long as I give them that attribute. Every client will still need an identity, and the identity will only work with the device the user chooses to enroll in that identity. Multiple devices will require multiple identity tokens, which is one of the great security features built-in. The Host The host, in my case, will be the device hosting my HomeAssistant server; this is my Raspberry Pi 4 on my local home network. Just like the client, this can be a person or device. I don't plan to host my HomeAssistant anywhere else, so in this case, I'll be granting permission to this single device alone. The Network Controller I chose to use Oracle Cloud Infrastructure (OCI) to host my OpenZiti controller as they have a , and it is actually that, free. No fine print says it's free for a certain amount of time or a free $100 of use. It's free and won't let you use premium features from paid plans unless you upgrade to a paid tier. free tier The controller will be the global point of access, this allows me to connect to my network on already open ports from anywhere where I can access the controller, which in this case is anywhere in the world. Building The Network The Network Controller The first thing I set up is my Oracle instance, for which I chose a standard Canonical Ubuntu image. I opened up the necessary ports for my needs. 8441 - The Controller port 8442 - The Edge Router port 8443 - The Ziti Console port (optional) 6262 - For Router to Controller communication 10080 - For Router to Router communication 22 - This one may already be open, but you should restrict it to your home IP Due to an OCI quirk, I had to open up those same five ports on the local firewall using sudo firewall-cmd --zone=public --add-port=8441/tcp --permanent
# ... repeat for other four ports
sudo systemctl restart firewalld Once all that was done, I SSH into my Oracle instance and run the following instructions for "Host it Anywhere" and that's it, seriously, the controller is all set up now and I even have an Edge Router set up for me as well. OpenZiti Express Install While we're here though, it would make sense to set up all the configurations we will need later. This can be done from your local computer since we have opened port 8441 to access the controller, or it can be done on the instance using SSH. At this point, I set up the following Create a client identity (to be enrolled later on a device of my choosing) Create a host identity that can be enrolled at creation Create a host service config Create a client service config Create a service Create service policies defining who/what can bind and/or dial the service The Host To set up the host, I need to run the Ziti Tunneler on my host machine. I used the and provide it with the JSON output from the host identity I enrolled after setting up the controller. ziti-tunnel-sdk-c The Client I used my mobile phone, so I sent the JWT to my phone. This JWT was created when I created the identity with the controller. With the Ziti Mobile Edge app found in the app store, I opened the JWT and enrolled my identity. There is a time limit on enrollment; this is given to you when you create the identity. It will also show when you load the JWT into the phone app. Note: The New Network Using OpenZiti Check Out My Feed What's Next? How cool is it that anyone I identify as in my household now has access to my cameras once provided an identity token? But what's even cooler is, say I go on vacation for a week, I can temporarily grant access to a house sitter by giving them the same attribute. Or I could also create another attribute or grant them permission explicitly based on their identity. Best of all, this was entirely free! #berl.household.member Now, to clarify, do you need HomeAssistant? no, this could have certainly been implemented in a way where I only had direct access to my CCTV. But, by using HomeAssistant, I can now expand my security to other devices on my network and start removing network access through designated smart device apps. But alas, you'll have to stay tuned for that one as it's saved for a future article. Published by Imran Aziz on behalf of Geoff Berl. Also published here.

How I Created a Zero Trust Overlay Network in my Home 

The Power of your Voice We sadly live in a world where: A woman for example, that fights for equality will get subjected to office harassment or social bullying because she expressed herself and may have offended some people. (some religions would even kill you for speaking out like this) these types of scenarios are endless in our society,(racial, political, sexual beliefs..etc) they reach globally and they touch every single person on this planet, the real problem is we have no place to seriously chat about it safely. Now, imagine a world where you can say things you feel deeply passionate about, and get a feeling of protection which empowers you to express yourself knowing it wouldn’t destroy your life, no matter how controversial, or extreme your opinions/ beliefs might be? I can’t even imagine how interesting and real social could become, this is something FB, or Snapchat could never do. networking Instagram Say Hello to DUSK DUSK is an anonymous live streaming video platform. We give people the strength to speak up, and express their honest self (something we don’t do). People can create real, open dialogs and discuss topics without being socially convicted, and attached to what others might find offensive or not aligned with their agenda. Sign up> Choose a @username, 4 digit pin (choose from 30 cool avatars to use) and you’re all set, no mobile number verification, no emails, nothing that tracks you. Q: How do you protect my identity while using the app? A: We’ll quickly onboard you to get your voice pitch disguised using our cool voice pitching technology, Then we permanently pixelate the screen when you’re recording live in our app, once in the app you can adjust your voice settings and screen pixelation settings if you want more or less anonymity, all this creates a closed loop of identity protection. Q: Wait, what? Is my identity truly safe? A: We didn’t collect any personal info about you, so how would people know who you are on DUSK?. We use all the best encryption too (https, Whatapps end-to-end..etc), even though we don’t store or collect any of your data, it’s important to keep everything secure for our users. We don’t know where you are, who you are, or anything else about you, and we don’t want to know. YES! Q: Can the videos and voice distortion be reversed or disabled? A: this is because no “original” state exists with your identity exposed, You're always protected when you use DUSK, all video and voice distortion happens locally on your device and not on our servers, we can not turn off the distortion ever, and no live video can leave your local device (phone) without being distorted, it’s technically impossible for this to happen. NO! Q: So this is a social networking app then? A: you can build up your followers by creating good content on DUSK, you create alter egos (Startup.L.Jackson) you can follow other interesting people too. We will notify you when someone you are following is broadcasting live. Like Periscope or FB live you can comment on live videos, but again you’re anonymous at all times on DUSK. YES, Q: Why did you build this app? A: people are so worried about saying the wrong things all the time, I’ve been a part of this culture too (I’ve deleted tweets because I was worried about backlash) it’s a shitty world to live in and it needs to be exposed. Look at all the people that get in hot water all the time over tweets, or things they publicly say. Maybe we can make a change, or help people, this is a great way to seek help or get advice, the possibilities are endless. I would love to hear an honest discussion from an anonymous user (e.g. Marc Andreessen talk about India’s colonialism) how raw and honest would that discussion be? it would be amazingly refreshing to our technology driven culture, and our world full of agenda driven fluff. Why not? Remember the point of protecting your identity is not to say mean things and hide, it’s designed to give you the strength to speak up, and express your honest self (something we don’t do) create real, open dialogs people can discuss without being social convicted, and attached to what others might find offensive or not aligned with popular agendas. Your welcome world!

Anonymity will become a social powerhouse

**TEL,AVIV, Israel, December 12th, 2023/Chainwire/--**StakingRewards, the leading platform for information on cryptocurrency staking, has created a dedicated guide to ORBS. It provides a detailed breakdown of Layer3 infrastructure project Orbs and a practical guide to staking its native token. The ORBS guide is part of an extensive revamp of the StakingRewards platform. StakingRewards aims to simplify the act of staking Proof-of-Stake (Pos) tokens to participate in network validation and earn rewards. The feature-rich site aggregates data from PoS chains, allowing users to view essential metrics at a glance. This allows crypto holders to make an informed decision about which PoS assets to stake and how to interact with them. The ORBS token now has its on StakingRewards that provides a wealth of useful data. Information on net staking flow, APR, risk, reward, percentage of tokens and wallets staked, and much more is supplied. Staking performance can be tracked over time and current token flow can be monitored, making it easy to determine asset inflows and outflows. own page ORBS stakers can use the StakingRewards portal to view a snapshot of the current staking ecosystem on Orbs and to compare it with the broader PoS market. An integrated calculator allows stakers to calculate their ORBS rewards and to adjust for variables such as compounding or non-compounding rewards. StakingRewards’ ORBS portal goes deeper by publishing a table of ORBS staking providers, known as Guardians. Users can assess the performance of each Guardian and select the provider who aligns with their needs. For the benefit of ORBS holders who have yet to stake their tokens, StakingRewards also provides a step-by-step tutorial that allows beginners to start earning their share of network rewards. StakingRewards is the leading portal for entering the $170B staking industry. It now tracks over 160 yield-bearing assets and more than 17,000 professional staking providers. The addition of ORBS to the StakingRewards platform signifies a commitment to providing users with accessible, reliable, and up-to-date information. In the process, it provides an entry point for crypto holders interested in exploring the world of staking, allowing them to rate assets according to community interest, security, and reward. About Orbs is a blockchain infrastructure project. Have been around since 2017, with the network and token live since 2019. Orbs is now focusing on building use cases supported by the network and tech. Orbs The most used protocols on Orbs now are dTWAP and dLIMIT - these are limit order and TWAP protocols that are 100% decentralized, EVM compatible, and can integrate with most DEXs. Currently live with multiple DEXs such as QuickSwap, SpookySwap, Thena, Chronos, and more. The project is being developed by a dedicated team of more than 30 people, with team members in Tel Aviv, London, New York, Tokyo, and Seoul. For more information, please visit , or join our community at: www.orbs.com Telegram: https://t.me/OrbsNetwork Twitter: https://twitter.com/orbs_network Contact Ran Hammer hello@orbs.com This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program . here

StakingRewards Platform Creates Comprehensive Guide To ORBS Staking

Photo by on NGO TUNG Unsplash My company, CriticalBlue, provides a remote mobile app authentication service called . An Approov SDK is provided as a drop-in library to native iOS and Android app developers. Approov With many of our customers using or experimenting with React Native, I wanted to provide a convenient Javascript module which exposes the native Approov SDK functionality to React Native developers. Overall, creating my first React Native native module was surprisingly straightforward. All code for my initial proof of concept is available in a . github repository React Native Bridge For react Native, Facebook provides a solid which goes over the basics, including how to set up an application and how the underlying UI components differ from the usual React web elements. getting started guide (from ) React Made Native Easy Architecturally, there are two important threads running in each React Native application — one a main UI thread and the other running a Javascript VM. The two threads interact through a bridge whose communication is asynchronous, serialized, and batched, decoupling the two systems as much as possible. While the bulk of the React Native app is described in React and runs on the Javascript VM, the UI is rendered using the native platform’s UI elements, and actions which alter the app’s UI are passed as messages through the bridge from the VM to the app’s main UI thread. System functionality and libraries developed for the native device environment can be exposed to the Javascript VM using React Native’s native module interface and accessed through the React Native bridge. Approov Native SDK The Approov SDK is a drop-in native iOS or Android library. It interfaces with the cloud-based Approov authentication service which validates that the app is genuine, untampered, and not a bot. An app integrity token is returned from the authentication service, and that token is sent with each API call to ensure that the back-end API service is dealing with a known and genuine front-end request. The basic operation we will expose in our native module proof of concept is , an asynchronous operation in the native SDK. fetchApproovToken() (Approov-protected API call) Before each back-end API call requiring app authentication, the client app makes a fetch token request. If a fresh token is needed, the SDK makes a remote attestation request, and the attestation service cryptographically authenticates the app and responds with an app integrity token. The token has a short lifetime and is signed by a secret known only to the Approov service and the app’s back-end service. No secret is stored in the app, and in fact the app does not know whether the returned token is valid or not. The app simply adds the integrity token to the back-end API call, and the back-end server validates that the token has not expired and is properly signed before processing the request. Approov Demo Service Approov offers a which provides demonstration iOS and Android SDKs and a back-end service with two endpoints: downloadable demo , which provides a publicly accessible test point. https://demo-server.approovr.io/hello , which provides a random shape only if the request contains a valid integrity token. https://demo-server.approovr.io/shapes We’ll use the Android SDK with the back-end service to demonstrate a simple React Native app using Approov. A version of this example using the iOS SDK with React native is also available. Saying Hello I started my React Native project using create-react-native-app (CRNA). Follow the to setup your React Native environment and then: CRNA installation instructions $ create-react-native-app rndemo I will be adding native code to the app, so go ahead and eject now from create-react-native-app: $ yarn eject
... ? What should your Android Studio and Xcode projects be called? rndemo Generating the iOS folder.
Generating the Android folder.
... $ cd rndemo Ejecting is permanent! Please be careful with your selection. ? How would you like to eject from create-react-native-app? React Native: I’d like a regular React Native project. We have a couple of questions to ask you about how you’d like to name your app: ? What should your app appear as on a user’s home screen? RN Demo Wrote to app.json, please update it manually in the future. Select a regular React Native project and name it as you wish. The iOS and Android projects are generated, and you will need and/or build environments installed. Native code will be added to the native Android project later on. Xcode Android Studio We will experiment with a very simple proof of concept app that will use the demo server hello endpoint to validate our network connectivity. React Native implements the for networking. We combine the connection check, UI rendering, and styling all in the file: fetch API App.js } }) })
    }) })
    });
  } }; );
  }
} }, }, }, }, },
}); import React from 'react' ; import { View, Image, Text, Button, StyleSheet } from 'react-native' ; import ShapeView from './ShapeView' export default class App extends React . Component { constructor ( props ) { super (props); this .state = { shape : 'logo' , status : '' }; // check connection checkConnection = () => { fetch( 'https://demo-server.approovr.io/hello' , { method : 'GET' , .then( ( response ) => response.text()) .then( ( text ) => { this .setState( previousState => { return { shape : 'hello' , status : 'connected' }; .catch( ( error ) => { this .setState( previousState => { return { shape : 'confused' , status : 'not connected' }; // render the app screen render ( ) { let pic = { uri : 'https://approov.io/images/approov_largelogo.png' return ( < View style = {styles.container} > < View style = {styles.header} > < Text style = {{fontSize: 24 }}> Approov Shapes </ Text > </ View > < ShapeView style = {styles.content} shape = {this.state.shape} status = {this.state.status}/ > < View style = {styles.footer} > < View style = {styles.buttonBar} > < Button onPress = {this.checkConnection} title = "Test Hello" /> </ View > </ View > </ View > // flexbox styles const styles = StyleSheet.create({ container : { flex : 1 , flexDirection : 'column' , backgroundColor : '#fff' , margin : 10 , header : { flex : .1 , flexDirection : 'row' , justifyContent : 'center' , content : { flex : .8 , flexDirection : 'column' , justifyContent : 'center' , alignItems : 'center' , footer : { flex : .1 , flexDirection : 'row' , justifyContent : 'center' , buttonBar : { flex : 1 , flexDirection : 'row' , alignItems : 'flex-end' , justifyContent : 'space-around' , // end of file The top-level App component is registered in the file. index.js The main view is rendered by a stateless view component which displays a choice of image and a status message: }; );
} }
}); import React from "react" ; import { View, Image, Text, StyleSheet } from "react-native" ; const shapeView = ( props ) => { const imgSrc = { 'logo' : require ( './assets/approov_largelogo.png' ), 'hello' : require ( './assets/hello.png' ), 'confused' : require ( './assets/confused.png' ), 'Rectangle' : require ( './assets/rectangle.png' ), 'Square' : require ( './assets/square.png' ), 'Triangle' : require ( './assets/triangle.png' ), 'Circle' : require ( './assets/circle.png' ) return ( < View style = {props.style} > < Image source = {imgSrc[props.shape]} style = {styles.shapeImg} /> < Text style = {{fontSize: 24 , marginTop: 10 }}> {props.status} </ Text > </ View > const styles = StyleSheet.create({ shapeImg : { resizeMode : 'contain' , height : 256 , width : 256 export default shapeView; // end of file I am using Android for these examples, but this works similarly on iOS. Fire up an Android emulator (you may need to launch Android Studio for this) or connect a phone via . In the directory, launch the app: adb rndemo $ yarn run android $ cd rndemo You should see a screen like this: Push the button and you should see a connected message if everything went okay: TEST HELLO This validates network communication between our React Native app and the demo server. You can set airplane mode on your phone or emulator and push the test button again to verify there is then no longer a connection. The Approov Native Module The Approov demo package includes a README, the iOS and Android Approov demo libraries, sample clients, and app registration tools. Download the , and save the app registration token which is included in your download email. demo package The Approov SDK includes the native code we want to expose to React Native. It must be included in the iOS or Android native projects which were generated when we ejected the create-react-native-app. For Android, this project is located at rndemo/android. Import the Approov SDK into the Android project by following these from the . instructions Approov docs An Android native module is described in Java by extending the ReactContextBaseJavaModule class. The getName() method must be implemented and provides the name of the module to Javascript. Methods exposed to React Native are adorned with @ReactMethod and may provide Javascript callback or promise mechanisms. We’ll use promises in our example. Facebook’s describes other capabilities such as sending events to Javascript and listening to lifecycle events. native module page We initialize the default configuration for Approov authentication in the native module constructor, and define ‘Approov’ in the getName() call. The exposed call wraps the asynchronous native and settles a promise when the token fetch completes. fetchApproovToken() fetchApproovToken() private Context context; ApproovConfig config = ApproovConfig.getDefaultConfig(reactContext);
            ApproovAttestation.initialize(config); }
    }

    @Override }

    @ReactMethod @Override promise.resolve(results.getToken()); }
        }, url);
    }
} package com.criticalblue.approov; import ... import com.criticalblue.attestationlibrary.ApproovAttestation; import com.criticalblue.attestationlibrary.ApproovConfig; import com.criticalblue.attestationlibrary.TokenInterface; class ApproovModule extends ReactContextBaseJavaModule { private static final String E_APPROOV_ERROR = "E_APPROOV_ERROR" ; public ApproovModule ( ReactApplicationContext reactContext ) { super (reactContext); this .context = reactContext; try { } catch (IllegalArgumentException ex) { } catch (MalformedURLException ex) { public String getName ( ) { return "Approov" ; public void fetchApproovToken ( final String url, final Promise promise ) { ApproovAttestation.shared().fetchApproovToken( new TokenInterface ( ) { public void approovTokenFetchResult ( ApproovResults results ) { if (results.getResult() == ApproovAttestation.AttestationResult.SUCCESS) else promise.reject(E_APPROOV_ERROR, "Failed to fetch Approov Token" ); A bundles and creates one or more native modules: ReactPackage @Override }

    @Override }
} package com.criticalblue.approov; import ... public class ApproovPackage implements ReactPackage { public List<ViewManager> createViewManagers ( ReactApplicationContext reactContext ) { return Collections.emptyList(); public List<NativeModule> createNativeModules ( ReactApplicationContext reactContext ) { List<NativeModule> modules = new ArrayList<>(); modules.add( new ApproovModule(reactContext)); return modules; The project’s main application implements ReactApplication and creates and returns a list of module packages. We add the Approov package to the list in . getPackages() @Override }

    @Override );
    }

    @Override }
  };

  @Override }

  @Override }
} package com.rndemo; import ... import com.criticalblue.approov.ApproovPackage; public class MainApplication extends Application implements ReactApplication { private final ReactNativeHost mReactNativeHost = new ReactNativeHost ( this ) { public boolean getUseDeveloperSupport ( ) { return BuildConfig.DEBUG; protected List<ReactPackage> getPackages ( ) { return Arrays.<ReactPackage>asList( new MainReactPackage(), new ApproovPackage() protected String getJSMainModuleName ( ) { return "index" ; public ReactNativeHost getReactNativeHost ( ) { return mReactNativeHost; public void onCreate ( ) { super .onCreate(); SoLoader.init( this , /* native exopackage */ false ); On the Javascript side, the Approov native module will now be included in the imported from . In our implementation, returns a normal javascript promise: NativeModules react-native Approov.fetchApproovToken() NativeModules.Approov.fetchApproovToken(input) }) }); import {NativeModules} from 'react-native' ; .then( token => { // do something useful... .catch( ( error ) => { throw error; Bridging the native and Javascript environments was surprisingly straightforward. Interceptors Many networking libraries, such as and tp, include the concept of an interceptor. Interceptors can be used to intercept network requests and responses and inject some additional processing. Axios OkHt When implementing natively with the Android SDK, most customers use interceptors to fetch an Approov token and add it to each API request’s headers, so we’ll want to fully implement this abstraction in our production module. For this simple example though, we’ll hardwire the interception in a fetchWithToken() call. In the fetchWithToken() method, when the native fetch token call completes, if the promise is resolved, we add the token to the input request headers and make a fetch() call with the augmented input request. When completed, the fetch returns a resolved promise holding the API server’s response. } }
                }) })
        }) })
}; import {NativeModules} from 'react-native' ; const fetchWithToken = ( input, options ) => { return NativeModules.Approov.fetchApproovToken(input) .then( token => { let optionsA = (options? {...options, headers :{ ...options.headers}}:{ headers : {}}); optionsA.headers[ 'Approov-Token' ] = token; return fetch(input, optionsA) .then( ( response ) => { if (response.ok) { return response; else { throw new Error ( 'HTTP response status is ' + response.status); .catch( ( error ) => { throw error; .catch( ( error ) => { throw error; const Approov = Object .assign({ fetch : fetchWithToken }, NativeModules.Approov); export default Approov; For convenience, we create an Approov object from the NativeModules.Approov object, adding a fetch() method which is actually the fetchWithToken() method, and then we export this as the Approov module. Getting Shapes Now we are ready to use the Approov object for authentication. We add a getShape() method inside our App which makes an Approov.fetch(request) call to authenticate and request a random shape value. Once the fetch completes, the App component state updates, triggering a render() call which causes the ShapeView to display an updated shape and status message. A GET SHAPES button is added to the button bar to request new shapes. }) } }) })
    }) })
    });
  } }; );
  }
} import Approov from './Approov' ; class App extends React . Component { // unchanged code ommitted for brevity... // get shape getShape = () => { Approov.fetch( 'https://demo-server.approovr.io/shapes' , { method : 'GET' , .then( ( response ) => { if (!response.ok) { throw new Error ( 'HTTP response status not OK.' ); return response.text(); .then( ( text ) => { this .setState( previousState => { return { shape : text, status : '' }; .catch( ( error ) => { const message = '' + error.message; this .setState( previousState => { return { shape : 'confused' , status : message }; // render the app screen render ( ) { let pic = { uri : 'https://approov.io/images/approov_largelogo.png' return ( < View style = {styles.container} > < View style = {styles.header} > < Text style = {{fontSize: 24 }}> Approov Shapes </ Text > </ View > < ShapeView style = {styles.content} shape = {this.state.shape} status = {this.state.status}/ > < View style = {styles.footer} > < View style = {styles.buttonBar} > < Button onPress = {this.checkConnection} title = "Test Hello" /> < Button onPress = {this.getShape} title = "Get Shape" /> </ View > </ View > </ View > Everything looks good, but when we request a new shape, we see a failure with a 400 status code, suggesting there is a problem with the client request. Failure to fetch a shape The call fails because the integrity token added by Approov is invalid. Until our example app is properly registered with the Approov service, the fetchWithToken() call will always fail the authentication check. Command line registration tools are included in the demo download. To register the app, issue a registration request specifying the App’s APK bundle and the app registration token you saved from the demo download email. As a courtesy to other demo users, set your registration to expire after a few hours using the -e flag: $ ./registration -t <registration-token>
   -e 2h
Submitting data… $ cd <<approov-demo-package>> /registration-tools/ Android/Mac/ -a <<rndemo-project>> /android/ app/build/outputs/apk/app-debug.apk Success : new app signature added to database.always be done. Once the app is registered and can be properly authenticated, pressing the GET SHAPES button should return one of these shapes: (Successfully fetching random shapes) Man in the Middle Attacks The security of the communication channel is very important during API calls. If the channel is insecure, an API call could be intercepted and modified. An integrity token, although it has a short lifetime, could be observed in the insecure channel and used to make malicious API calls with impunity. Despite using HTTPS/TLS when making API requests, an attacker who controls both the network and the mobile device can easily setup a to steal and quickly reuse Approov tokens before they expire. Man in the Middle (MitM) attack To counter MitM attacks, mobile clients should use which checks that the certificate or public key presented by the back-end service is known specifically by the client app. Other certificates, though they might appear authentic, will be rejected by the client, and no API calls will be made. certificate or public key ‘pinning’ Implementing pinning in React Native is a bit complicated and will be described in a separate article and integrated into this example’s code repository. Going Further We’ve demonstrated a native module implementation in React Native with a hardwired interceptor successfully providing app authentication and API protection. A production quality native module implementation for React Native would generalize the interceptor functionality, add convenience configuration methods, and provide full MitM protection. For comparison, a similar already exists for and hybrid apps. Approov plugin library Cordova Ionic All code for this example is located on . github Thanks for reading! For more information on mobile API security, check out . www.approov.io I’d really appreciate it if you recommend this post (by clicking the 👏 button) so other people can find it.

HELLO NETWORK

hellonetwork.ca

-- employees

Since n.d.

COMPANY RANKING

HELLO NETWORK

EVERGREEN INDEX #4874

Representing this company? Click here to claim and customize this page!

Hello Network WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

HELLO NETWORK

hellonetwork.ca

-- employees

Since n.d.

COMPANY RANKING

HELLO NETWORK

EVERGREEN INDEX #4874

RELATED COMPANIESRANK

STORIES ABOUT HELLO NETWORK

Representing this company? Click here to claim and customize this page!

Hello Network WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!