4 ms·
If you're trying to debug your own app, there are ways to turn this off for debugging.
by andrewguenther 10y ago
If you're trying to debug your own app, there are ways to turn this off for debugging.
- kuschku 10y agoAnd if you want to use your legal right to reverse the functionality and APIs of other apps?
- johncolanduoni 10y agoIf your device isn't rooted, modify the APK to opt-in and don't share it with anyone. If your device is rooted, just add your cert to the system store.
- kuschku 10y ago> If your device is rooted, just add your cert to the system store. So, basically the same as before, but there’s no UI for it anymore? Fuck this. I might just modify the Java SSL libs on Android to even accept my cert when cert pinning is used, if I have to spend that much effort anyway.
- click170 10y agoI share your frustration and I'm interested in your work on this, if you do proceed please consider making it easy for others to follow your lead by publishing, anonymously if necessary. I get that the intention is to make the device more secure but Google's execution on this is disappointing and lazy, and the result is that my devices no longer trust me the owner, which I don't consider acceptable given the lack of liability. I'm curious what Apple's response will be.
- GeneralTspoon 10y agoIf you plan on doing that, it might be worth looking into a similar project that uses the XPosed framework to bypass certificate pinning at a low level: https://github.com/iSECPartners/Android-SSL-TrustKiller https://github.com/iSECPartners/Android-SSL-TrustKiller Although it only works with Android versions up to 4.2.2, due to limitations of the XPosed framework.