3 ms·
Except that, IMO, I should be able to MITM the connection between an app on my phone and any server it’s talking to, for auditing purposes. In that case, CA/sys
by shawkinaw 8y ago
Except that, IMO, I should be able to MITM the connection between an app on my phone and any server it’s talking to, for auditing purposes. In that case, CA/system trust-based systems let me do that relatively easily with a proxy. If the app sets up its secure connection with its own, uncustomizabe trust store, I can’t.
- tptacek 8y agoAppsec firms routinely test iOS applications with pinned certificates.
- throwaway2048 8y agoI doubt many app makers (or users for that matter) are interested in allowing that.
- slrz 8y agoI don't think that loading up a debug build with your dev certificates builtin is too much of a hassle for enabling MITM hooks.
- Sophira 8y agoI believe the parent comment is talking about auditing apps as a user, not as a developer, in which case debug builds will not be available.