4 ms·
> In order to confirm this suspicion, I decided to proxy my phone’s traffic and attempt registering with the app using dummy phone values. Am I wrong in assumi
by charonn0 10y ago
> In order to confirm this suspicion, I decided to proxy my phone’s traffic and attempt registering with the app using dummy phone values.
Am I wrong in assuming that being able to proxy the app's HTTPS traffic is evidence of another security problem, specifically that the app is not validating the server's SSL certificate?
- zaroth 10y agoNo, the proxy is a trusted CA and so it can mint a valid cert. It does mean they are not pinning their cert, but most apps do not. Even if it was pinned, you just have to disassemble and modify the pin and you can still MITM.