Any modern day browser provides feedback to the end user confirming whether or not you are using HTTPS and some basic validation of the cert.
When using a mobile application it seems the end user has no way to verify whether or not their comms are secure. Short of attempting a MiTM using something like ARP cache poisoning is there any way I can verify whether or not a mobile application is using HTTPS?
If the app is using HTTPS and I inject a self signed cert using Fiddler it seems the OS steps in and warns me. At least in this scenario if the app is using HTTPS and someone attempts a MiTM I am warned. However, if the app is using HTTP a MiTM can sit there all day long and as the end user I can only assume it's either secured and the cert is OK or that it's not secured and hope for the best...
Much like app permissions, which can be verified by the user at install time, we could do with a 'secure communications' flag that indicates the OS will not allow unsecured comms to leave the app. Is there such a way to assert this level of security within a mobile app that is not simply an assertion from the developer but something that can be enforced or proven?