A lot may have changed but here's a few blog posts on various MITM/cert pinning bypasses that some people have done: https://blog.tendigi.com/starbucks-should-

A lot may have changed but here's a few blog posts on various MITM/cert pinning bypasses that some people have done: https://blog.tendigi.com/starbucks-should-really-make-their-apis-public-6b64a1c2e923 https://blog.tendigi.com/starbucks-should-really-make-their-... https://jeffhuang.com/extracting_my_data_from_the_hello_sense.html https://jeffhuang.com/extracting_my_data_from_the_hello_sens... https://blog.dewhurstsecurity.com/2015/11/10/mobile-security-certificate-pining.html https://blog.dewhurstsecurity.com/2015/11/10/mobile-security... I just had these bookmarked from when I was wondering the same thing