We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our attacker is able to observe and decrypt the app's traffic using a tool such as Fiddler.
As I understand it, Fiddler inserts a certificate in the middle and acts as a proxy. Fiddler is able to provide the attacker a decrypted version of the data stream.
Should certificate pinning remove the ability for an attacker to observe the HTTPS traffic? With our mobile app in the wild, I have to assume the app can be installed on a rooted/jail-broken device.