Hacker News Reader

Comment by dzhiurgis | Hacker News Reader

How do you do MITM SSL when pretty much every secure app use key pinning.

Exactly, on iOS it's not easy, on Android it's far easier because the OS listens to you, not Apple or Google, and it's far easier to root Android than it is to jailbreak iOS, or run an open source fork like LineageOS and run the same apps on that.

You can (a) decompile the app, mod it, recompile it, sign it, and then execute it (b) modify the OS to not care about app signatures (c) bypass it with Xposed hooks, ... lots of ways.

I find hard to believe that you can decompile any app that has bothered implementing key pinning (which I always assumed is done at app level, not OS).

Speaking of https, I will give my own example. I can get to the cockpit (local ip:9090) of my fedora machine on my android phone if I continue past the scary warning but not on my iphone.

You can most definitely bypass the invalid certificate warning on iOS (I also have a device that uses a self-signed certificate and listens on a local IP, I can open its web interface just fine on iOS)

I can bypass the self-signed cert error on my iPhone 8 on iOS 14.4.2

That aside, what's the point? There's no practical threat model where https makes what you're doing more secure. If you have neither a domain name that can use a real TLS cert nor your own CA added to the mobile device, it would be trivial for someone to MITM you. Just configure your Fedora dashboard to use http if you don't care about security

Reply on news.ycombinator.com