Re:Twitter starts to require login to view tweets
by powvans on Tuesday August 24, 2021 @02:00PM
(#28292617)
Mobile developers can implement certificate pinning to prevent man in the middle snooping. Twitter's app does this.
[ Parent
| on HN ]
Re:Twitter starts to require login to view tweets
by arsome on Tuesday August 24, 2021 @02:07PM
(#28292697)
That achieves nothing against someone who uses something like apktool/baksmali to do static RE, let alone inject something like Frida to perform dynamic RE. There are even Xposed modules designed to just bypass certificate pinning.
Certificate pinning is a good security measure, but not a counter-RE one.
Re:Twitter starts to require login to view tweets
by saagarjha on Wednesday August 25, 2021 @03:46AM
(#28299016)
Certificate pinning is neither a good security measure nor a good obfuscation one.
Re:Twitter starts to require login to view tweets
by feanaro on Tuesday August 24, 2021 @03:16PM
(#28293522)
I hope you did not just assume that general purpose computing and device ownership can be subverted by mere certificate pinning.
If it's executing on my device, you can be sure I can poke it and see what it's doing.