Hacker News new | ask | show | jobs
by pwdisswordfishz 663 days ago
> That’s like saying the entire point of TLS is to prevent users from looking at the traffic being sent to a website.

In the case of mobile apps, it is.

1 comments

Can you clarify that statement?
A lot of mobile apps use TLS connections when communicating with their backends.

You can MITM the traffic, and continue to deliver the traffic using a self signed certificate that you’ve trusted on your mobile device, and boom, you can capture the traffic at your proxy point and be happy.

A lot of mobile apps use certificate pinning to ensure that the backend certificate matches what the app expects. Now your self signed certificate, even though it’s trusted at the OS level, no longer matches the certificate that the app is expecting, and no data is exchanged after TLS handshake fails.

A lot of mobile apps use TLS with certificate pinning, so even if the user installs a system-wide root CA, the app doesn't accept it and won't let the user look at what data is being sent to the servers.