3 ms·

At least on Android you can generate a fake VPN-esque connection locally that passes everything through a proxy, so the proxy isn't exposed to the application

• MichaelGG 10y ago
  Sure but then the verification will fail since you won't be able to sign the handshake with the "pin'd" cert. (Assuming they implement TLS or other crypto in their own code.) If you aren't modifying the execution environment then it's possible for an app to be "safe".
  • fdsaaf 10y ago
    An clever-enough emulator can just lie to an application and say, "You're running on a stock device. Everything is fine".
    • pki 10y ago
      Clever-enough is the key word, with Safetynet involved, which dynamically executes signed classes and you don't know what checks will be done