3 ms·

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random fre

by yodon 9y ago

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

deleted 9y ago
[deleted]
cbrevik 9y ago
I’d guess App Store reviews stops that.
gdavisson 9y ago
Setting up Charles requires two explicit authorization steps (each requiring passcode/fingerprint/face verification): First, network interception requires adding a VPN config (the dialog warns that "All network activity on this iPhone may be filtered or monitored when using VPN"). Second, SSL MITM requires installing and trusting a root CA certificate (the relevant prompts in iOS are less clear -- they say that the cert will not be trusted until you enable it, but don't explain the implications if you do enable it).
tinus_hn 9y ago
The documentation states you have to follow the instructions to install the certificate manually which is what I would expect. You can also click a link to a certificate on a webpage and install it manually on iOS.
tzahola 9y ago
1. You have to turn on VPN in the system settings. 2. You have to trust the Charlesproxy root certificate; again, in the system settings.
- eddieroger 9y ago
  1a. This requires your passcode, and any time a system is asking for your permission to do something is worth questioning. Even my least technosavvy friends and family have learned that if something is asking for your password and you don't know why, abort.
mavhc 9y ago
How is that different from Android?
mihaela 9y ago
"what’s keeping any random free game app from doing the same" It's not that simple, as author stated, it was some of the most challenging code he ever wrote. Charles desktop app is well respected in the developer community. There is no reason that the iOS app will be treated any differently.

by yodon 9y ago

deleted 9y ago

[deleted]

cbrevik 9y ago

I’d guess App Store reviews stops that.

gdavisson 9y ago

Setting up Charles requires two explicit authorization steps (each requiring passcode/fingerprint/face verification): First, network interception requires adding a VPN config (the dialog warns that "All network activity on this iPhone may be filtered or monitored when using VPN"). Second, SSL MITM requires installing and trusting a root CA certificate (the relevant prompts in iOS are less clear -- they say that the cert will not be trusted until you enable it, but don't explain the implications if you do enable it).

tinus_hn 9y ago

The documentation states you have to follow the instructions to install the certificate manually which is what I would expect. You can also click a link to a certificate on a webpage and install it manually on iOS.

tzahola 9y ago

1. You have to turn on VPN in the system settings. 2. You have to trust the Charlesproxy root certificate; again, in the system settings.

eddieroger 9y ago
1a. This requires your passcode, and any time a system is asking for your permission to do something is worth questioning. Even my least technosavvy friends and family have learned that if something is asking for your password and you don't know why, abort.

mavhc 9y ago

How is that different from Android?

mihaela 9y ago

"what’s keeping any random free game app from doing the same" It's not that simple, as author stated, it was some of the most challenging code he ever wrote. Charles desktop app is well respected in the developer community. There is no reason that the iOS app will be treated any differently.