4 ms·

Can you please explain how you got to that conclusion?

kupopuffs 6y ago
Obviously makes it harder for others to log your traffic
mschuster91 6y ago
Not OP, but it's very hard to intercept and monitor the traffic of an app that uses code signing, obfuscation and certificate pinning properly. What used to be a five minute "put tcpdump on the access point / router to work" job pre-HTTPS everywhere now is a many days worth job of messing around - out of reach for all but the really dedicated, and as a result it is very hard for an user to have actual visibility over where their data flows.
- captn3m0 6y ago
  I'd say this is a consequence of making our phones opaque rather than HTTPS-everywhere. Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a desktop that lets you strip SSL easily. Doing the same on our mobile devices is much more tougher, because we've let feature phones become walled gardens.
  - mschuster91 6y ago
    > Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a desktop that lets you strip SSL easily. Not if the app uses certificate pinning, ships its own version of a SSL library and uses code-signing and obfuscation to prevent you messing around with it. As for the walled garden part: I agree with the general sentiment, but on the other hand I also see the lengths malware authors go to gather data from people. There really is no one-fits-all solution here, because anything that allows the user to intercept and monitor SSL communication can automatically be used by an attacker! :(
    - captn3m0 6y ago
      > Not if the app uses certificate pinning, ships its own version of a SSL library and uses code-signing and obfuscation to prevent you messing around with it. Are there desktop apps that behave this way? Atleast in my experience - I haven't come across anything like this on Linux.
      - mschuster91 6y ago
        Dropbox does: https://knowledge.broadcom.com/external/article/169397/dropbox-ssl-interception-and-issues-when.html https://knowledge.broadcom.com/external/article/169397/dropb... And I seriously hope cert pinning gets adopted by more applications.
      - dylz 6y ago
        Many desktop apps behave this way, yes. Anything from a major tech co should at least
- deleted 6y ago
  [deleted]
- lopmotr 6y ago
  Does that really matter though? Isn't the proper way to evaluate what data is being shared to assume each app exploits its permissions up to the level of trust you have in the company that provided it? Eg. if you worry Facebook is stealing your contact list, then if their app has that permission, you should assume they are stealing it. No need to bother checking if they actually are. They might do it when you're not looking anyway. As for data being sent from your device to 3rd parties, again, if you don't trust the app's developer not do to that, you also won't trust them not to be sharing it from their end where you have no way to look at the traffic.
  - brandonr49 6y ago
    There's a bit of circular logic here because I can't evaluate who to trust if I can't effectively monitor what the developer is doing on my machine.

Obviously makes it harder for others to log your traffic

Not OP, but it's very hard to intercept and monitor the traffic of an app that uses code signing, obfuscation and certificate pinning properly. What used to be a five minute "put tcpdump on the access point / router to work" job pre-HTTPS everywhere now is a many days worth job of messing around - out of reach for all but the really dedicated, and as a result it is very hard for an user to have actual visibility over where their data flows.

captn3m0 6y ago
I'd say this is a consequence of making our phones opaque rather than HTTPS-everywhere. Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a desktop that lets you strip SSL easily. Doing the same on our mobile devices is much more tougher, because we've let feature phones become walled gardens.
- mschuster91 6y ago
  > Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a desktop that lets you strip SSL easily. Not if the app uses certificate pinning, ships its own version of a SSL library and uses code-signing and obfuscation to prevent you messing around with it. As for the walled garden part: I agree with the general sentiment, but on the other hand I also see the lengths malware authors go to gather data from people. There really is no one-fits-all solution here, because anything that allows the user to intercept and monitor SSL communication can automatically be used by an attacker! :(
  - captn3m0 6y ago
    > Not if the app uses certificate pinning, ships its own version of a SSL library and uses code-signing and obfuscation to prevent you messing around with it. Are there desktop apps that behave this way? Atleast in my experience - I haven't come across anything like this on Linux.
    - mschuster91 6y ago
      Dropbox does: https://knowledge.broadcom.com/external/article/169397/dropbox-ssl-interception-and-issues-when.html https://knowledge.broadcom.com/external/article/169397/dropb... And I seriously hope cert pinning gets adopted by more applications.
    - dylz 6y ago
      Many desktop apps behave this way, yes. Anything from a major tech co should at least
deleted 6y ago
[deleted]
lopmotr 6y ago
Does that really matter though? Isn't the proper way to evaluate what data is being shared to assume each app exploits its permissions up to the level of trust you have in the company that provided it? Eg. if you worry Facebook is stealing your contact list, then if their app has that permission, you should assume they are stealing it. No need to bother checking if they actually are. They might do it when you're not looking anyway. As for data being sent from your device to 3rd parties, again, if you don't trust the app's developer not do to that, you also won't trust them not to be sharing it from their end where you have no way to look at the traffic.
- brandonr49 6y ago
  There's a bit of circular logic here because I can't evaluate who to trust if I can't effectively monitor what the developer is doing on my machine.