[Aissen]

Even without certificate pinning, starting with Android 7, you must decompile the app to allow user provided certificates. Or use an xposed module if you have a rooted device.

See this mitmproxy bug: https://github.com/mitmproxy/mitmproxy/issues/2054

And this tool is nice to automate decompiling, adding the line in the manifest to be able to use user-installed certificates, and recompiling: https://github.com/levyitay/AddSecurityExceptionAndroid

Also, if the app uses Google signin, you have to be rooted, because play services uses the package manager to check the app signer before giving the app a token.

[justinjlynn]

Just wait until they go full 'treacherous computing' and turn on remote attestation using TPMs.

[Aissen]

Remote attestations already exist with SafetyNet, but don't use TPMs (IIRC). TPMs are interesting because they allow local attestations; and it's happening already, for some use cases: https://android-developers.googleblog.com/2017/09/keystore-k...

[justinjlynn]

wow... thanks for the link. I need to keep a closer eye on the platform, apparently.