Why can't you call communication absolutely safe just because you use HTTPS, and which well-known attacks still work there?
HTTPS stops eavesdropping and tampering on the path. A man in the middle through a malicious or user-installed CA, SSL stripping that pushes you to HTTP, DNS hijacking, a phishing domain with a valid certificate, and a compromised endpoint (a jailbroken device or the server) all remain.
SecurityShort answerBasics
A legacy partner API still supports only HTTP, so your app's requests fail. What is ATS…
#https #tls
SecurityMultiple choiceIntro
If an app does all its communication over HTTPS, which of these is not guaranteed by that…
#https #tls
SecurityShort answerAdvanced
Users report that the campaign page you load in an in-app WKWebView shows carrier or…
#https #dns
SecurityMultiple choiceBasics
Why doesn't HTTPS (TLS) encrypt all the data with the server's public key (RSA/ECC)…
#https #tls