4 ms·
Certificate pinning has made this a pain in the arse.
by Muley 6y ago
Certificate pinning has made this a pain in the arse.
- oefrha 6y agoYou can only pin your own certificate, not someone else’s. In this case you probably don’t even need SSL proxying to pin down the culprit, as I dare say not many apps connect to wikimedia on startup. You do need SSL proxying to be sure though.
- zwily 6y agoThe app may not load at all with mitmproxy if it has pinned its server cert though.
- oefrha 6y agoNo, you can selectively decrypt HTTPS requests for only some domains, and act as passthrough for others.
- ohgodplsno 6y agoNope. Starting from Android 10, unless an app has explicitly allowed user certificates (and no-one reasonably does, it's all behind a <debug-overrides> flag), you will not be able to MITM it. You may inject your certificates as much as you want. The only option is to have a device on which you have root access, which can push system certificates with adb. This pretty much only means the android emulator these days.
- oefrha 6y agoI don’t use Android so I wasn’t aware of that. But that’s a completely separate concern from cert pinning which does not hinder decrypting third party connections at all. Edit: after looking into this a bit, this is pretty nuts. How do enterprises inject certificates now?
- olliej 6y agore enterprise injection: They don't. It's been made increasingly clear that allowing certs roots to infect unrelated apps is a Bad Thing. MDM profiles etc presumably allow internal certs to be deployed, but those are hopefully limited as countries, let alone companies, have attempted to use those mechanisms to spy on millions of people.
- matheusmoreira 6y agoSo it's still possible on rooted devices? Seems good enough.