I'm currently building a MVP (financial mobile app) and trying to understand the best ways to prevent rogue clients interacting with the server.
When looking at the security of most mobile apps I can see that it's fairly easy to do a MITM attack on these to intercept the communication over SSL.
Some apps seem to prevent these with certificate pinning but that's also very easy to overcome on a jailbroken phone.
(I see that in this thread Do client certificates provide protection against MITM? it is possible for the server to verify the client - but it appears in practice that virtually no one does this? - not sure why and is it due to possible some inflexibility in pinning a client certificate on the server?)
I can see that a couple of the most secure apps I have looked at, implement certificate pinning on the client, the server then sends an additional public(?) key (which I can see in charles proxy) so most likely a second private-public key exchange, but I can no longer track communications after that. (originally this app like many other financial apps seem to do out-of-bands security via sms).
In short: 1)What are the additional security options available to securing my app which go beyond certificate pinning on the client (and prevent rogue clients accessing the server?) (Excluding jailbreaking prevention).
2) How does the out-of bands- type security work, and how does this give additional protection?