1

The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking.

I'm back-end developer and recently, I started to work with fiddler to intercept requests coming from mobile apps to debug and API... And exploring the tool, I saw that fiddler has and configuration that use some of these certs and decrypt header and body of a request and response.

I'd like to know if it's safe having these self signed certs installed in computer for some applications use, like Fiddler, Postman for instance, don't they open security breaches?

  • You may want to consider using separate accounts on your computer. One account for personal use and another for business. – Daisetsu Mar 23 at 0:53
0

I'd like to know if it's safe having these self signed certs installed in computer for some applications use, like Fiddler, Postman for instance, don't they open security breaches?

When you use intercepting proxies such as Fiddler and/or BurpSuite, the certificate needs to be imported in your browser. You have to trust this certificate in order to intercept HTTPS traffic.

The certificate that you are trusting is generated on your computer and is supposed to be different for all users that install these tools. In case of paranoia, you could regenerate the certificate after installing these tools (at least I know it is possible in BurpSuite)

I'd recommend only installing the certificate in the (one) browser only and use other browsers to do your non-developing work such as banking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.