News for hackers. Stuff that matters.

A comment on I found a security issue on a competitor, got fired and served a summons. Parent comment

Re:I found a security issue on a competitor, got fired and s... by DaiPlusPlus on Wednesday March 16, 2022 @09:45PM (#30706596)
> Using anonymisation proxies just makes it all the more suspicious

If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer or anything of the sort, it's just the macOS equivalent of Fiddler: a localhost HTTP/HTTPS proxy that lets you decrypt TLS traffic (provided the client software isn't using certificate-pinning, which it wasn't).

From TFA:

> Wondering how I could feed them to the app, I set up Charles Proxy and pointed my phone to it. I honestly thought this wouldn’t work – who at this time doesn’t have SSL Pinning?

https://www.charlesproxy.com/

https://www.telerik.com/fiddler

As a curious user of other applications I've done the same thing the the author has described, so this kinda stuff isn't uncommon - except in my case I've never had an opportunity to stumble across anything as bad the author.

As for phone-app' insecure back-end web-services: that's about par for the course thesedays, even for banking and other "secure" services. It's depressing. I have plenty of my own pet-theories as to why things seem worse today than they were 10 years ago, but that's another discussion.

[ Parent | on HN ]
Re:I found a security issue on a competitor, got fired and s... by Aachen on Wednesday March 16, 2022 @09:59PM (#30706710)
> If you're referring to the author's use of Charles Proxy, it's *not* an anonymizer

I am not, I was referring to the suggestions broadly shared elsewhere in the thread of doing this anonymously instead.

[ Parent | on HN ]