3 ms·
Ehh, I don't think it'd be that hard to implement cert pinning against OpenAI's APIs. You just need some very permissive pinning, where you require any publicl
by varenc 4y ago
Ehh, I don't think it'd be that hard to implement cert pinning against OpenAI's APIs.
You just need some very permissive pinning, where you require any publicly trusted CA, to prevent MITM attacks. Basically only trust the root CAs a phone already trusts by default. You don't need coordination between the server and your client to implement this. All you have to do is prevent your TLS calls from trusting any certs signed by manually trusted CAs that Proxyman/Charles/etc might have had the user add.
Of course, that'll only delay the API keys leaking. With a jailbroken iPhone and Frida you can effectively disable cert pinning checks. Or extract the keys from memory, or binary analysis, etc.
- thewataccount 4y ago> All you have to do is prevent your TLS calls from trusting any certs signed by manually trusted CAs that Proxyman/Charles/etc might have had the user add. Yeah but I have certs signed by trusted root authorities a la letsencrypt?
- varenc 4y agoThe letsencrypt root CA is included in this. If you trust only a device’s default trusted CA all letsencrypt certs will work. Also they don’t have their own root CA: https://letsencrypt.org/certificates/ https://letsencrypt.org/certificates/
- thewataccount 4y agoI'm dumb and realized I can get a letsencrypt cert but the domain won't match.....