4 ms·
Is there an alternative to prevent people from doing MITM attacks on mobile apps? With HPKP running, apps with Charles requires a rooted device.
by jkooper 9y ago
Is there an alternative to prevent people from doing MITM attacks on mobile apps? With HPKP running, apps with Charles requires a rooted device.
- jakub_g 9y agoFor mobile apps it's easier than for websites because native apps have more control over what's going on than the website, and can read the details of http connections (so in worst case, you can roll out your own pinning). For Android there are a built-in facilities for that in modern versions: https://developer.android.com/training/articles/security-config.html https://developer.android.com/training/articles/security-con... For iOS: not an expert, but this article seems good https://dzone.com/articles/ssl-certificate-pinning-in-ios-applications https://dzone.com/articles/ssl-certificate-pinning-in-ios-ap... It might get a bit trickier when WebViews are involved though because, at least on Android, SSL in WebView is subject to different security rules than the java-initiated connections (AFAIU the problems due to https://www.chromium.org/developers/androidwebview/webview-ct-bug https://www.chromium.org/developers/androidwebview/webview-c... could not have been avoided on the app side, for example, as it was a bug in Chromium).
- strcat 9y ago> It might get a bit trickier when WebViews are involved though because, at least on Android, SSL in WebView is subject to different security rules than the java-initiated connections They've started changing that: https://developer.android.com/about/versions/oreo/android-8.0-changes.html#o-sec https://developer.android.com/about/versions/oreo/android-8....