0

I have a mobile app that queries various 3rd party API/sites (these are https links). I have a concern that SSL proxies (e.g. Charles) can be used to intercept the traffic - man in the middle.

Are there any instances that charles would not ables to read the traffic?

It seems crazy to me that something basic like SSL proxy can undermine a well used technology - TLS.

What are my options to mitigate against a SSL proxy decrypting the traffic and possibly seeing sensitive information?

Would Public key pinning be a possible mitigation ? Anything else?

marked as duplicate by Steffen Ullrich tls Jul 16 at 13:21

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Pinning is not a mitigation, it is just a way to not blindly fall to MITM. But if proxy itself cannot be avoided, then you don't have much options. – Crypt32 Jul 16 at 13:01
  • @Crypt32 thanks for your response. Am i right in thinking that with pinning the mobile app would only connect to the legit web server and bypass the proxy? would this mean traffic cannot be intercepted by the proxy? – Architect Jul 16 at 13:09
  • Nope. With pinning, app will receive and reject the certificate from proxy. Depending on a proxy configuration (if it is HTTPS Inspection), client will be unable to connect to legit server, because it will never receive legit certificate (specified in pin). – Crypt32 Jul 16 at 13:12
  • @Crypt32 what would prevent the mobile app never receiving the certificate from the legit server? – Architect Jul 16 at 13:21
  • Proxy server. When you connect to remote server (legit), your HTTPS connection will be split in two parts: clien-proxy and proxy-server. Legit certificate will terminate on proxy. Proxy will present to you only its autogenerated certificate. – Crypt32 Jul 16 at 13:24