2 ms·

Most of these services have public documentation about how they work in terms of network oriented APIs, or failing that some sort of SDK whose structure will ty

Most of these services have public documentation about how they work in terms of network oriented APIs, or failing that some sort of SDK whose structure will typically be representative of the network traffic. For example this is what Dropbox say https://www.dropbox.com/developers/core/api https://www.dropbox.com/developers/core/api You can reverse engineer protocols for the purposes of interoperability in Europe. However there are various fine print details that matter and changes in the last few years. The wikipedia page has a summary and references to the legislation http://en.wikipedia.org/wiki/Reverse_engineering#European_Union http://en.wikipedia.org/wiki/Reverse_engineering#European_Un... However if those services have been written correctly they will be using SSL and you shouldn't be able to see what is going on with network sniffers (other than DNS names and traffic analysis). That means reverse engineering the software which is hard and time consuming (eg you need to know assembly and using debuggers at that level). Some like Skype use anti-reverse engineering techniques. Tools like IDA help as a starting point. However chances are that all that software you downloaded had some sort of click agreement that you agreed to saying you won't reverse engineer the software. That adds another layer of legal issues you need to address.

nicothieb 14y ago
You can actually analyse most ssl traffic with a man in the middle proxy. All you need to do is to reencrypt the the data with your own certificate and accept to signing certificate as trusted on your computer. SSL is not obfuscation, it is about maintaining a chain of trust.
- rogerbinns 14y ago
  I've written one of those before(1). For general browser traffic it isn't problem since you can add the proxy cert to the browser or whatever it uses. For apps (ie non-browser) it will depend on their certificate checking code, which for best practise should not accept any old gunk the OS/browser does. (1) For a test I used my bank which had all sorts of RSA checked and similar logos all over the "secured" pages. Needless to say those logos remained even though I was going through a man in the middle.

nicothieb 14y ago

You can actually analyse most ssl traffic with a man in the middle proxy. All you need to do is to reencrypt the the data with your own certificate and accept to signing certificate as trusted on your computer. SSL is not obfuscation, it is about maintaining a chain of trust.

rogerbinns 14y ago
I've written one of those before(1). For general browser traffic it isn't problem since you can add the proxy cert to the browser or whatever it uses. For apps (ie non-browser) it will depend on their certificate checking code, which for best practise should not accept any old gunk the OS/browser does. (1) For a test I used my bank which had all sorts of RSA checked and similar logos all over the "secured" pages. Needless to say those logos remained even though I was going through a man in the middle.