I am testing Mobile Device Management.

Here, the Admin needs to publish WiFi configurations (SSID, Password, Security Type etc.) to the mobile over the air. So what should the approach be of sending the wifi password to the device? (i.e. it should be encrypted on server and decrypted on the device)

When I intercepted the request in burp, I am able to see the wifi password in plain text, but developers are saying it is okay because HTTPS was used.

What are the other ways if developer doesn't encrypt the wifi password?

  • 1
    What are you trying to protect yourself from? Why do you think HTTPS is not secure enough? – MechMK1 Jun 20 at 11:37
  • @MechMK1 , I am trying to protect from MITM attack. Also if the traffic is ever sniffer (via breaking HTTPS) at least the clear-text password doesn't leak. – Chacha Jun 20 at 12:03
  • 1
    How do you plan on "breaking HTTPS"? – MechMK1 Jun 20 at 12:11
  • That's the different scenario, any idea about my scenario? – Chacha Jun 20 at 13:06
  • I don't understand what the treat is you are trying to protect yourself from. – MechMK1 Jun 20 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.