Re:Ask HN: No HTTPS – Why do you trust an app?
by patmcc on Thursday February 04, 2016 @02:41PM
(#11036585)
You have to trust the organization, same as always. If your bank/credit union doesn't use https in their app, they probably don't have a secure infrastructure period.
If the organization you're dealing with is incompetent, it doesn't matter if you communicate with https, carrier pigeon, or face-to-face. They'll still leave things open at some point and you'll get screwed.
And, as heinrichf points out, you can MITM and name-and-shame individual apps if you're technical.
Re:Ask HN: No HTTPS – Why do you trust an app?
by heinrichf on Thursday February 04, 2016 @12:21PM
(#11035461)
You can redirect the traffic of your device through a proxy and sniff it (e.g. https://mitmproxy.org/) to determine if an app uses https or not, and furthermore if it performs certificate pinning.
Re:Ask HN: No HTTPS – Why do you trust an app?
by newsignup on Thursday February 04, 2016 @12:55PM
(#11035749)
Yes but how would general public know about it? Its strange that whole of the web has moved so far with the https and yet apps have no such way of knowing.
Re:Ask HN: No HTTPS – Why do you trust an app?
by MarkMc on Thursday February 04, 2016 @06:07PM
(#11038009)
A similar problem is that many apps ask me to log in with my Facebook password. With a browser I can see that my password is being sent directly to Facebook but with an app, who knows?
If the organization you're dealing with is incompetent, it doesn't matter if you communicate with https, carrier pigeon, or face-to-face. They'll still leave things open at some point and you'll get screwed.
And, as heinrichf points out, you can MITM and name-and-shame individual apps if you're technical.
"WebViews Are Not To Be Trusted" https://web.archive.org/web/20140213214723/http://matthodges...