Consider the following scenario.
- Eve creates an access point in a public place.
- Alice connects to the AP via mobile phone and starts browsing the Web.
- Eve redirects Alice to a registration page and suggests to Alice to read and accept terms and conditions bla-bla and install an SSL certificate.
- As far as Alice is an ordinary mobile user, she thoughtlessly installs the certificate (she just clicks the Okay button since the registration message contains more than 140 characters). Most important is that it's a one-step procedure on most mobile devices.
- Now Eve can perform a MITM attack. She can hijack HTTP(S) traffic.
Consider yourself as a Bob's mobile application developer. How can we prevent the described attack? Can we even do that? Feel free to suggest your solution for any mobile OS.