2 ms·

Embedding those into your app will not work - it makes it marginally more difficult for a dedicated attacker but it's not rocket science to extract. iOS does h

Embedding those into your app will not work - it makes it marginally more difficult for a dedicated attacker but it's not rocket science to extract. iOS does have something built-in that you can use to identify whether the requests coming to your API are legitimate, though - which you may find useful here: https://developer.apple.com/documentation/devicecheck https://developer.apple.com/documentation/devicecheck https://developer.apple.com/documentation/devicecheck/establishing_your_app_s_integrity https://developer.apple.com/documentation/devicecheck/establ... This, of course, will not help with Android or another ecosystem.

somgen_ 4y ago
Yes I already thought that it would be possible to extract the certificates including the password despite obfuscation. The documentation you‘ve linked is quite interesting - didn’t heard about this before, thanks! I also found that Cloudflare is currently adding support for device attestation: https://blog.cloudflare.com/private-attestation-token-device-posture/ https://blog.cloudflare.com/private-attestation-token-device... unfortunately it’s still in a closed beta. But that seems the way to go I guess. Out of curiosity could you provide me with some more details regarding how obfuscation does not help when storing the password for the certificate inside the source code?