QA reports that with a Charles proxy in place they see every API request and response from your app in the clear. How do you decide whether that's a real security problem?
The user installed a root certificate on their own device, so TLS is working as designed, and you judge it by asking whether the threat is the device owner abusing the API by reading their own traffic.
SecurityMultiple choiceBasics
What conditions have to hold before a tool like Charles or Proxyman can show an app's…
#mitm #proxy #charles #pinning
NetworkingShort answerBasics
How can tools like Charles and Proxyman show app traffic that's encrypted with HTTPS in…
#mitm #proxy #charles
SecurityShort answerAdvanced
How would you implement certificate pinning (SSL pinning) on iOS?
#mitm
SecurityShort answerIntro
What does your app lose on a jailbroken device?
#threat-model