4 ms·
One can always reverse whatever internal API the main site uses, and/or steal the API key from the official app.
by civby 3y ago
One can always reverse whatever internal API the main site uses, and/or steal the API key from the official app.
- flangola7 3y agoIf they really want to be dicks they can limit it to only accept connections from their official signed app.
- cced 3y agoHow? As an aside, if anyone has any good resources on inspecting cert-pinned traffic using an Android VM and Frida, I’m all ears.
- flangola7 3y ago> How? https://developer.apple.com/documentation/devicecheck/establishing_your_app_s_integrity https://developer.apple.com/documentation/devicecheck/establ... https://developer.apple.com/documentation/devicecheck/validating_apps_that_connect_to_your_server https://developer.apple.com/documentation/devicecheck/valida...