Yeah, I does sound like that but it also says persistently DNS poisoning or ARP poisoning isn't very persistent. So there COULD be something here...but I don't

Yeah, I does sound like that but it also says persistently DNS poisoning or ARP poisoning isn't very persistent. So there COULD be something here...but I don't think so In my experience, most mobile apps use cert pinning or regular ol https. Only a few that I have seen actually use http. The biggest thing mobile apps do is client-side checks instead of server-side, since an assumption of network connectivity can't be made. It's pretty funny the types of things you'll find. Anyways... edit: Oh wow. I watched the video. That's embarrassing. "We haven't done a responsible disclosure because everyone knows HTTP is just like that"