News for hackers. Stuff that matters.
Re: by twleo on Friday September 15, 2023 @04:04PM (#37528465)
Looks good. I hate how IOS does, especially with certificate pinning, so I cannot use my ad-block http mitmproxy to block ads in Apps.

EDIT: thanks for people clarifying that pinning is done by Apps and not by IOS.

Re: by kelnos on Friday September 15, 2023 @04:11PM (#37528542)
That's not necessarily specific to iOS. Certificate pinning is usually done inside an app, not at the OS level. An app can choose to ignore the system certificate store and, for example, pin the cert used to talk to its private API. This is possible both on iOS and Android.
Re: by ShrimpHawk on Friday September 15, 2023 @04:08PM (#37528514)
iOS is even easier than Android to add system certificates and can be done without rooting or jailbreaking the device unlike android. cert pinning is done by the apps not the system.
Re: by jeroenhd on Friday September 15, 2023 @04:30PM (#37528726)
Another note: cert pinning is made very easy by Android as well (just needs a fingerprint in an XML file).

It's a good feature for security (stalkerware remains a huge problem) but it does suck from a reverse engineering standpoint.

Re: by jiofj on Friday September 15, 2023 @04:07PM (#37528503)
cert pinning is done by the apps, not by the OS
Re: by rwmj on Friday September 15, 2023 @04:20PM (#37528636)
That's a distinction without a difference in these tightly controlled ecosystems.
Re: by ladberg on Friday September 15, 2023 @04:27PM (#37528706)
Android apps could also do certificate pinning with the same effect though? In this case there isn't any difference between Android and iOS in functionality.
Re: by WirelessGigabit on Friday September 15, 2023 @06:09PM (#37529698)
Would you mind sharing your setup?