Fiddler Can decrypt https traffic

Question

So apparently, a software called fiddler is able to very easily decrypt secure https traffic with a click of a few buttons: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/DecryptHTTPS

I know fiddler is a credible piece of software, but surely you cannot just start decrypting secure https traffic using this tool, so easily.

Whats the catch here guys? Is there more to it? is there any requirements?

I just wish to learn more about this.

Thanks.

Please do a little research before asking questions. The products main pages explain exactly what's going on: telerik.com/fiddler/web-traffic-recording — schroeder♦, Apr 13 '15 at 17:21

Community · Accepted Answer · 2017-03-17 10:46:01Z

2

They are doing a man-in-the-middle attack which needs the user to either ignore security warnings or to explicit import the CA used by fiddler. For more discussion about this topic have a look at How can I prevent a man-in-the-middle (MITM) attack on my Android app API?

Community♦

1

answered Apr 13 '15 at 8:58

Steffen Ullrich

130k17 gold badges235 silver badges301 bronze badges

add a comment |

1 Answer 1