3 ms·

Remember, app authors, pin your cert roots! :)

• lucb1e 3y ago
  if you want to DRM your app, yeah. In that case, also don't forget to check for microG or root (super scary stuff, a user having admin on their own device, imagine!) and ensure that the device isn't muted during ads as well as disabling app backups (they might be able to get at their own data!!1) and turning off screenshots (no benefit, but it can be claimed to be a security benefit just like denying root and turning off backups, and it will serve to further annoy the user). If you don't mind that users can see what you're leaking to the server from their device, or sending to their device, then please don't use certificate pinning, or at least make it an option... Not sure which side you're on here
  • lxgr 3y ago
    Unfortunately, there's two types of users MITMing apps, opening their browser's dev console etc.: Those that know what they are doing (i.e. tinkering with the app to find out what makes it work or to modify it), and those that have no idea what any of this means and that get instructed by scammers on the internet (e.g. phone support scams) to do so.
  • sgammon 3y ago
    I’m on the side of guaranteed transport security. What in the world are you talking about? I’m all for privacy but that is regulated via other means — the law.