Ask HN: What do you do with your Raspberry Pi?

Re:Ask HN: What do you do with your Raspberry Pi? by punnerud on Tuesday June 25, 2019 @01:17AM (#20271392)

If you use MITMProxy or Charles you can easily intercept the traffic on 99% of all iPhone/Android apps (bit harder if pinned-sertificate). These API’s are often stable because a lot of users don’t update their apps that often.

[ Parent | on HN ]

Re:Ask HN: What do you do with your Raspberry Pi? by throwbaccAndy on Tuesday June 25, 2019 @06:38AM (#20272781)

For newer android apps this is no longer true. By default, apps only trust system CA's. User added System CA's are not trusted by apps. I believe only the browser uses the user added CA's.

[ Parent | on HN ]

Re:Ask HN: What do you do with your Raspberry Pi? by punnerud on Tuesday June 25, 2019 @10:14AM (#20274374)

That is why these systems generate their own certificate that you add to your phone, so you still can see the traffic.

For MITMProxy you can visit http://mimt.it when the setup is running.

A bit more difficult with “pinned-setificate” where you have to:

1) Decompile the app (easy if you search for the online APK-download and APK-decompile tools)

2) Move the certificate out of the APK and use it for the traffic between MITMProxy/Charles and the server

3) Replace the certificate in the APK with one generated for MITMProxy/Charles, or just delete it if that works for the app (most likely not)

4) Re-compile the APK and install on your device

5) Run MITMProxy/Charles as before, just with some parameters to load the “pinned-certificate”

(There is also a lot of guides for this. Maybe not for pinned-certificate.)

[ Parent | on HN ]

Re:Ask HN: What do you do with your Raspberry Pi? by popotamonga on Tuesday June 25, 2019 @06:05PM (#20279519)

1) decompile 2) remove the line that does the pinning (Easy to find) 3) recompile and sign

5 minutes

[ Parent | on HN ]

Re:Ask HN: What do you do with your Raspberry Pi? by KirinDave on Tuesday June 25, 2019 @10:25AM (#20274493)

It can be crazier than that. App makers who work with important APIs often pin to specific certificates (not signers) so we have an one final absolute emergency measure to kill a version and force an upgrade when we have to.

[ Parent | on HN ]

Re:Ask HN: What do you do with your Raspberry Pi? by punnerud on Tuesday June 25, 2019 @10:29AM (#20274546)

That is what I refer to as pinned-certificate. Not often used except from some of the biggest companies like Facebook and Snapchat. See my answer on how to go around this.

[ Parent | on HN ]

Re:Ask HN: What do you do with your Raspberry Pi? by KirinDave on Tuesday June 25, 2019 @12:23PM (#20275803)

Your answer sure wouldn't work for my tiny startup's app's pinning and we followed a guide initially.

[ Parent | on HN ]