Hacker News Reader

Could Snapchat have detected this? What is the defense against this type of attack?

Certificate pinning would defeat this. Bake it into your app that you only trust a specific certificate regardless of what is in the system trust store.

Interestingly, not always. For example apple computers will intentionally ignore your pinning attempts in some cases: https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-securi...

Yikes, that’s a good reason not to use the system LibreSSL or curl provided with macOS.

Cert Pinning and Certificate Transparency should block the decryption, even on a VPN where the user has installed a custom root certificate.

It wouldn't stop them seeing what domains the user is going to (as it's sent in plaintext because of SNI, and ECH was still a few years away).

The same techniques make it more difficult for a user/developer to figure out what their device is doing.

Reply on news.ycombinator.com