search

Ogadai / zwift-mobile-api

MIT License
120 stars 25 forks source link

Zwift communication protocol changing to mandate encryption #32

Open snicker opened 2 years ago

snicker commented 2 years ago

xposting from https://github.com/wiedmann/zwift-packet-monitor/issues/5

Hey folks,

I'm a backend engineer at Zwift and want to bring to your attention some upcoming changes that are likely to affect your project.

In July we are rolling out a new encryption protocol that will affect all UDP and TCP communication between client and server, and also between client and the Zwift Companion app (ZC), in order to meet a new requirement from Google Play (they recently changed their user data safety policy).

The rollout will span several days and you may see both encrypted and unencrypted clients running concurrently during that period. It is expected that by July 20th we will have all our communication fully encrypted.

After July 20th, unencrypted clients will be considered deprecated, but still supported. Eventually, however, Zwift will enforce encryption for all clients, but that date is still to be determined.

How exactly that affects your project will depend on what it does:

  • server clones: they won't be affected by encryption while unencrypted communication is still supported. Encrypted clients must negotiate encryption with the server, and they will simply fall back to unencrypted communication if the server doesn't know any better. When encryption is enforced, however, these projects will stop working;
  • ZC clones: they won't be affected during that initial phase either. Encrypted clients must also negotiate encryption with ZC, and they will also fall back to unencrypted in case of pre-encryption ZCs. When encryption is enforced, however, these projects will stop working;
  • client sniffers: those will be immediately impacted when rollout starts. Not only is the protocol specification changing, but the very payload being sniffed by those projects is now encrypted. Logic that relies on reading user data from network packets will simply fail if the data is encrypted, as one would expect;
  • BLE and ANT+ devices: projects that emulate either BLE or ANT+ devices won't be affected, not even after encryption is enforced (unless of course they also fit any of the roles aforementioned). We are not changing those communication protocols in any way.

Please note that this change is required to secure user data, not to discourage community projects. We are internally discussing if and how we can help community projects go through the change and continue working. That said, please have in mind that this is not merely an engineering decision, but it must also involve other departments like Product and Legal. We will post further updates here as soon as we have any news.

We'll also try our best to answer questions, depending on the availability of our backend engineering team. You can trust replies from any of the engineers listed here.

Ride On!

th00ber commented 1 year ago

How to use this package in 2023 ? Any update ?