News for hackers. Stuff that matters.

A comment on Decrypting TLS Browser Traffic with Wireshark. Parent comment

Re:Decrypting TLS Browser Traffic with Wireshark by mobiplayer on Friday February 13, 2015 @04:44AM (#9043593)
Wait a second...

Was the fake cert trusted by your phone? If affirmative, did you manually add the root cert from your fake CA or at least accepted that cert as trusted?

If you didn't explicitly trust that cert and the application didn't complain we're in front of another completely wrong use of SSL.

[ Parent | on HN ]
Re:Decrypting TLS Browser Traffic with Wireshark by ecesena on Friday February 13, 2015 @12:10PM (#9045381)
No, not trusted. That's why I was sad. The app failed to verify the certificate chain and silently continued over the (in)secure connection.
[ Parent | on HN ]