I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS?
And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android device, and started up BlurpSuite on my Ubuntu Machine.
The first request I saw was some Exchange ActiveSync call to a corporate Server via SSL.
In this request, BurpSuite, on my Ubuntu Machine, presented me the fully readable and unencrypted headers, including the base64 encoded credentials.
Also this thread clearly states the headers should be also encrypted: http://stackoverflow.com/questions/187655/are-https-headers-encrypted
How's this possible? Do I overlook something?
What worries me that I assumed that SSL avoids trickery by man-in-the-middle attacks, but this doesn't seem to apply here.