<story><title>Reverse Engineering Native Apps by Intercepting Network Traffic</title><url>http://nickfishman.com/post/50557873036/reverse-engineering-native-apps-by-intercepting-network</url></story><parent_chain><item><author>shawkinaw</author><text>Wow, this guy has the completely opposite attitude of me. He seems to think it&amp;#x27;s a bad thing, an attack!, for users to see just what the hell data you&amp;#x27;re pulling off someone&amp;#x27;s phone. And, bizarrely, uses an example of an app that essentially stole data from its users.&lt;p&gt;I should be able to see what data an app is sending, and certificate pinning (and ATS according to another comment) kills that. That&amp;#x27;s not a good thing.</text></item></parent_chain><comment><author>userbinator</author><text>It&amp;#x27;s not an uncommon attitude, and it&amp;#x27;s also one I detest --- many articles about &amp;quot;security&amp;quot; have some authoritarian&amp;#x2F;paternalistic aspects to them. Then again, encouraging ignorant users is the easiest way to monetise, analyse, and otherwise manipulate them... and if this ignorance is a convenient byproduct of arranging things so &amp;quot;it&amp;#x27;s for your security&amp;quot; ostensibly, all the better.&lt;p&gt;The obligatory related link: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.gnu.org&amp;#x2F;philosophy&amp;#x2F;right-to-read.en.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.gnu.org&amp;#x2F;philosophy&amp;#x2F;right-to-read.en.html&lt;/a&gt;</text></comment>
<story><title>Reverse Engineering Native Apps by Intercepting Network Traffic</title><url>http://nickfishman.com/post/50557873036/reverse-engineering-native-apps-by-intercepting-network</url></story><parent_chain><item><author>shawkinaw</author><text>Wow, this guy has the completely opposite attitude of me. He seems to think it&amp;#x27;s a bad thing, an attack!, for users to see just what the hell data you&amp;#x27;re pulling off someone&amp;#x27;s phone. And, bizarrely, uses an example of an app that essentially stole data from its users.&lt;p&gt;I should be able to see what data an app is sending, and certificate pinning (and ATS according to another comment) kills that. That&amp;#x27;s not a good thing.</text></item></parent_chain><comment><author>matchu</author><text>Certificate pinning &lt;i&gt;does&lt;/i&gt; prevent an important class of MitM attacks, though.&lt;p&gt;I think some applications use certificate pinning when validating a certificate provided by a default certificate authority, but, if you &lt;i&gt;manually&lt;/i&gt; install a root certificate onto your device, the app will accept the override. That&amp;#x27;s one possible middle ground.</text></comment>