[Release] 3DSafe: In-NAND PIN lock for 3DS

Discussion in '3DS - Flashcards & Custom Firmwares' started by mashers, Sep 7, 2016.

  1. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
    Actually one could just place ReiNAND's boot.firm into the root of the SD card and boot right on past the Luma3DS.
    Wow, that security flaw went right over my head.
     


  2. SoslanVanWieren

    SoslanVanWieren GBAtemp Advanced Fan

    Member
    667
    96
    Feb 6, 2017
    Australia
    you can make the pin file and config file on sd card read only and have a pin on the ctr nand one to
     
  3. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
    Except when if you place another CFW like ReiNAND on the root of the SD card. B9S considers that priority and boots that instead. So literally using another CFW that ignores the Luma3DS files will completely bypass the Luma3DS security.
     
    Last edited by Lilith Valentine, Jul 30, 2017
    Quantumcat likes this.
  4. gamesquest1

    gamesquest1 Nabnut

    Member
    14,118
    9,453
    Sep 23, 2013
    Luma security is more like one of this little plastic locks on kids diaries, and tbh if/when ntrboothax is released all possible protections are made pretty much useless, even 3dsafe wouldn't stand up against ntrboothax
     
    Quantumcat and Lilith Valentine like this.
  5. SoslanVanWieren

    SoslanVanWieren GBAtemp Advanced Fan

    Member
    667
    96
    Feb 6, 2017
    Australia
    yeah but if the person does not know what cfw is they will have no idea how to bypass it
     
  6. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
    It's a decent enough measure to stall someone, but I just publicly revealed the security flaw. Which now means that it only requires a quick google search to reveal this flaw. Trust me, I just looked up, "3ds lock screen" and found a link on reddit, which lead me to this thread. Hell just bringing me to this site is enough for anyone to make a thread asking for help and finding out about this security flaw.
    This is a very serious flaw that actually can't be fixed through Luma3DS. The only way to completely remove this flaw is to make B9S boot from CTRNAND as priority, which is not a good idea.
     
    Last edited by Lilith Valentine, Jul 30, 2017
  7. SoslanVanWieren

    SoslanVanWieren GBAtemp Advanced Fan

    Member
    667
    96
    Feb 6, 2017
    Australia
    yeah but im using it to stop a kid getting into my 3ds not an adult younger kids are more likey to mess with your 3ds and if its some one whos not going to bother to try to try to bypass it will work
     
    Last edited by SoslanVanWieren, Jul 30, 2017
  8. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
    That's something different and honestly something like Luma3DS's lock screen will easily lock out kids. Although I would like to add to my previous post. This isn't completely directed at you, but directed at the concern of "Why is it a bad idea to set CTRNAND to priority?"
    The reason it would be a bade idea is because it actually opens the user to outside attack. If the user has Luma3DS on their CTRNAND and doesn't have the lock screen setup, then it leaves their system open for someone else to setup that lock screen on them. Since B9S boots from SD over CTRNAND, it's easy enough to fix this by booting the system off a boot.firm stored on the SD card. If the system booted CTRNAND as priority, then the user is basically fucked until NTRBootHAX is released or the attacker releases the system.
    So basically this security flaw is something that can be fixed, but then it opens the system to external security flaws.
     
  9. cearp

    cearp the ticket master

    Member
    7,464
    4,704
    May 26, 2008
    Tuvalu
    Just fork bs9 to support a pin itself.
    Solved...? I think so
     
    Quantumcat and MadMageKefka like this.
  10. SoslanVanWieren

    SoslanVanWieren GBAtemp Advanced Fan

    Member
    667
    96
    Feb 6, 2017
    Australia
    I know passcodes arent meant for anti theft with phone passwords there's also a bypass by erasing all the stuff on the phone they are meant to stop kids from messing with your phone and people trying to get personal information.Heck, even the parental controls on the 3ds is bypassable with a website that generates a pin. If there was no bypass your device would be bricked if you forgot the passcode
     
    Last edited by SoslanVanWieren, Jul 30, 2017
  11. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
    Yeah~ but I feel like too many people think these measures are some form of "theft protection," so I was just doing my part to point out flaws and why they exist. I felt like I left my last comment rather vague as it should have gone into greater detail. Like I said, it wasn't directed at you, I just didn't want to multi-post.
    But you are right, these kinds of security setups are more so a low level preventative than an actually security system.
     
    Last edited by Lilith Valentine, Jul 30, 2017
  12. SoslanVanWieren

    SoslanVanWieren GBAtemp Advanced Fan

    Member
    667
    96
    Feb 6, 2017
    Australia
    But some people feel what they have on there 3ds is private to them even if its just what games are on it.
     
  13. gamesquest1

    gamesquest1 Nabnut

    Member
    14,118
    9,453
    Sep 23, 2013
    tbh at this point most phones do use pin locks as anti theft devices with both android and iOS locking the phone when formatted unless you can login with the previously used account so the phone is effectively a brick and only any foot for spare parts

    Maybe a similar solution could be dreamt up for the 3ds with a email recovery key for,although again with ntrboothax looming the effectiveness of such a solution is going to be pretty short
     
    Last edited by gamesquest1, Jul 30, 2017
  14. lonewolf08

    lonewolf08 GBAtemp Fan

    Member
    416
    134
    Feb 4, 2016
    United States
    Yeah, I mentioned this to Lilith in a PM but even if ntrboothax were released, 3dsafe still offers protection from most people. Not everyone is going to have a compatible flash kart to do so or want to pay for said flash kart to do so. 3dsafe is already bypassed with a hard mod so chances of someone having the necessary things to accomplish the ntrboothax vs just anybody that can change a file and 3dsafe still has the upper hand. Let's also not forgot that 3dsafe let's you have your info and it can give incentive for them to give it back for a reward.
     
    MadMageKefka likes this.
  15. BARNWEY

    BARNWEY THE MLG DINOSAUR

    Member
    1,224
    478
    Oct 11, 2016
    United States
    Imagination
    Exactly, though you can bypass them...
     
  16. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
     
  17. BARNWEY

    BARNWEY THE MLG DINOSAUR

    Member
    1,224
    478
    Oct 11, 2016
    United States
    Imagination
    My bad, I didn't see those XD
     
    Lilith Valentine likes this.
  18. Lilith Valentine

    Lilith Valentine GBATemp's Wolfdog™ I drool on my knife

    Member
    19,674
    20,388
    Sep 13, 2009
    Antarctica
    Between insane and insecure
    Yeah, this entire page actually seems to be me bringing up security flaws <.<
     
  19. BARNWEY

    BARNWEY THE MLG DINOSAUR

    Member
    1,224
    478
    Oct 11, 2016
    United States
    Imagination
    Oh, I see that now... I posted that before I had coffee this morning XD
     
    Lilith Valentine likes this.
  20. SoslanVanWieren

    SoslanVanWieren GBAtemp Advanced Fan

    Member
    667
    96
    Feb 6, 2017
    Australia
    just make the luma boot firm on the sd card read only and the config and pin files read only that way the only way to bypass it is to use a diffrent sd card and they would not have access to most of your games if they did that.
     
    Last edited by SoslanVanWieren, Jul 31, 2017
    hurrz likes this.