Hacker News Reader

Comment by bri3d | Hacker News Reader

I really wish Charles generated a self-signed cert on installation, rather than using a root that you download from them.

I suspect that a lot of people in the iOS dev community (where Charles seems ubiquitous) walk around with the Charles root on their phone, ripe for an easy malicious MITM against them.

I'm also surprised more iOS and Android apps don't bundle and pin their certificates - it's still an obscurity measure since, worst comes to worst, the user can root / jailbreak the device and attach a debugger or watch the network stack, but it keeps any random user with Charles (or random malicious attacker with a stolen root cert) from reversing private APIs.

View on HN

I believe Fiddler does this

edit: Details on the process: http://blogs.telerik.com/fiddler/posts/13-08-19/faq---certif...

Relevant Quote: "Every Fiddler root certificate is uniquely generated, per user, per machine. No two Fiddler installations have the same root certificate. The only way for a Fiddler user to be “spoofed” by a bad guy is if that bad guy already is running code inside the user’s account (which means you’d already be pwned anyway)."

Every other product I can think of (Proxy.app, MITMproxy, and so on) also uses self-signed certificates generated at startup / configuration time rather than a shared root - I think that design is unique to Charles.

Charles does allow you to use your own certificate, but it's not the default user flow.

I see the ease-of-use case for the way Charles does it, but the shared-certificate approach is so insecure (you're basically handing the keys to all of your unpinned SSL traffic to anyone on the Internet) that I wish it would go away.

I also really like Fiddler and the warnings it provides are excellent. Sadly, it doesn't really support OSX yet so many iOS developers can't use it.

A very awkward way of using Fiddler from OS X would be via a Windows VM that had Fiddler set up to allow connections from other machines.

I also found it hard to set up Charles to use a custom cert, definitely had to read the instructions on their site instead of trying to figure it out on my own.

Certificate pin bypass for Android: https://github.com/iSECPartners/Android-SSL-TrustKiller

iOS: https://github.com/iSECPartners/ios-ssl-kill-switch

Sure it's a little bit extra work but not much. If someone is reversing your app chances are they are using a jailbroken device anyways to extract the unencrypted IPA or to attach gdb to your app.

I agree. I'm glad people don't though, as I like de-privatising "private APIs" ;)

You can use Proxy.app (http://www.websecurify.com/desktop/proxy.html) which does that. As for the certificate pinning - it makes proxying a very difficult.

mitmproxy does this.

Reply on news.ycombinator.com