Hacker News Reader

HNHacker News

Top New Best Ask Show Jobs

Comment by andrewguenther | Hacker News Reader

Parent Full thread

andrewguenther·

If you're trying to debug your own app, there are ways to turn this off for debugging.

View on HN

And if you want to use your legal right to reverse the functionality and APIs of other apps?

If your device isn't rooted, modify the APK to opt-in and don't share it with anyone.

If your device is rooted, just add your cert to the system store.

> If your device is rooted, just add your cert to the system store.

So, basically the same as before, but there’s no UI for it anymore?

Fuck this.

I might just modify the Java SSL libs on Android to even accept my cert when cert pinning is used, if I have to spend that much effort anyway.

I share your frustration and I'm interested in your work on this, if you do proceed please consider making it easy for others to follow your lead by publishing, anonymously if necessary.

I get that the intention is to make the device more secure but Google's execution on this is disappointing and lazy, and the result is that my devices no longer trust me the owner, which I don't consider acceptable given the lack of liability.

I'm curious what Apple's response will be.

If you plan on doing that, it might be worth looking into a similar project that uses the XPosed framework to bypass certificate pinning at a low level:

https://github.com/iSECPartners/Android-SSL-TrustKiller

Although it only works with Android versions up to 4.2.2, due to limitations of the XPosed framework.

Reply on news.ycombinator.com