4 ms·
It's already been noted that the application itself doesn't verify the validity of TLS certs, so it's trivial to MITM the connection and there are currently peo
by abstractbeliefs 10y ago
It's already been noted that the application itself doesn't verify the validity of TLS certs, so it's trivial to MITM the connection and there are currently people working to learn the ins and outs of the API.
- Dylan16807 10y agoIt verifies certs, it just doesn't pin them. So if you can hack your phone, you can hack it, shocker. Not a security flaw.
- chatmasta 10y agoAnd if you can hack your phone, you can disable pinning.
- cocotino 10y agoNo need to hack anything, just install your own cert
- bognition 10y agoCurious why you don't think this is a security flaw. Surely a browser failing to pin certificates would be a bad thing, no?
- wepple 10y agobrowsers generally don't pin certs. there are methods to do it but everyone is scared to do it as it's a pretty quick way to DoS your entire user-base if you get it wrong. The intended design of PKI suggests that pinning should not be a thing. unfortunately PKI is broken and pinning is a 'patch' because it's too each to obtain a cert for a property you don't own (hi bluecoat)
- darklajid 10y agoThere are legitimate reasons to extend the trusted root certificates (notably: corporate deployments). Admitted, I cannot come up with a reason that has anything to do with Pokemon, but - in general I think this should be possible. Plus: Who do you want to protect and from whom? The only person able to make Pokemon Go (locally, on their phone) accept another certificate is by having full access to the phone in the first place. It's the user, 'hacking' his own device. If this leads to exploits on the Pokemon Go server for some reason, than _those_ are the problems. The communication between app and Pokemon Go server uses TLS, even if I spoof a certificate for my very own device. For me this is one of the examples of Raymond Chen's "If you're already on the other side of the hatch it isn't a security exploit", but I might absolutely fail to understand the risks of course.
- bognition 10y agowow, thanks for the reply. Although i'm not sure why my question was downvoted...
- ionwake 10y agoHas anyone made any progress ?
- nathancahill 10y agohttps://www.reddit.com/r/jailbreak/comments/4s6rx7/discussion_pokemon_go_megathread/ https://www.reddit.com/r/jailbreak/comments/4s6rx7/discussio...
- ionwake 10y agoThanks!
- netcraft 10y agoim not interested in hacking or modifying things, but would love to get api access to the data - can you link to a forum where this stuff is being worked on?