3 ms·
I'd say this is a consequence of making our phones opaque rather than HTTPS-everywhere. Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a des
by captn3m0 6y ago
I'd say this is a consequence of making our phones opaque rather than HTTPS-everywhere. Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a desktop that lets you strip SSL easily.
Doing the same on our mobile devices is much more tougher, because we've let feature phones become walled gardens.
- mschuster91 6y ago> Setting a HTTPS-connect proxy (I use Zap) is a 2 minute process on a desktop that lets you strip SSL easily. Not if the app uses certificate pinning, ships its own version of a SSL library and uses code-signing and obfuscation to prevent you messing around with it. As for the walled garden part: I agree with the general sentiment, but on the other hand I also see the lengths malware authors go to gather data from people. There really is no one-fits-all solution here, because anything that allows the user to intercept and monitor SSL communication can automatically be used by an attacker! :(
- captn3m0 6y ago> Not if the app uses certificate pinning, ships its own version of a SSL library and uses code-signing and obfuscation to prevent you messing around with it. Are there desktop apps that behave this way? Atleast in my experience - I haven't come across anything like this on Linux.
- mschuster91 6y agoDropbox does: https://knowledge.broadcom.com/external/article/169397/dropbox-ssl-interception-and-issues-when.html https://knowledge.broadcom.com/external/article/169397/dropb... And I seriously hope cert pinning gets adopted by more applications.
- dylz 6y agoMany desktop apps behave this way, yes. Anything from a major tech co should at least