Certificate pinning means you cannot insert yourself as the backend and/or MITM the requests. The app will only communicate directly with the owner of the private key it was pinned to.
Depending on the app and OS, it may be more or less easy to change the app to remove/crack the pinning. In general, if you are not in full control of the device (root), it's not possible.
It means the payload is. HTTPS alone doesn't have any special considerations for hiding the domain, which I think is visible so the request can be routed correctly. And since a lot of ad-blocking is based on domain, that ought to work.
very very easy, no root required
it's even easier than that as all apps (except native ones) will be using the java TrustManager interface
> Also, it takes more than one byte if the binary is obfuscated
but they can't hide the calls into TrustManager
a small utility could automatically take in the APK, patch out the calls and return the fixed APK for you
(would probably work for 99% of apps out of the box)
Is this required? i.e. do all apps have to use the TrustManager interface to accomplish cert pinning, or is that merely the official way?
well, Java is Turing complete, so you could completely re-implement TLS yourself instead of using the API that comes with the platform
in practice no-one is going to do that