undefined | Better HN

0 pointsidunno2469y ago0 comments

the thing is...as long as its a frame inside the app i have zero way of knowing whether im actually looking at googles login page, or if niantic is reading the traffic/javascript. At least when I get bounced out to safari I only have to trust apple, which I already implicitly do.

0 comments

tedmiston9y ago

If you want to be paranoid, you could run a MITM proxy from your computer between your phone and Niantic's servers.

joosters9y ago

And see TLS traffic? How would this help anyone?

tedmiston9y ago

My comment was downvoted for some reason... perhaps I'm mistaken (haven't tried myself) but I'm fairly confident Charles can do this. I've heard of using it to reverse engineer APIs from mobile apps that use SSL, Robinhood for example.

https://www.charlesproxy.com/

> Charles can be used as a man-in-the-middle HTTPS proxy, enabling you to view in plain text the communication between web browser and SSL web server.

From https://www.charlesproxy.com/documentation/proxying/ssl-prox...

kiallmacinnes9y ago

A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.

1 more reply

j / k navigate · click thread line to collapse

0 pointsidunno2469y ago0 comments

0 comments

tedmiston9y ago

If you want to be paranoid, you could run a MITM proxy from your computer between your phone and Niantic's servers.

joosters9y ago

And see TLS traffic? How would this help anyone?

tedmiston9y ago

https://www.charlesproxy.com/

> Charles can be used as a man-in-the-middle HTTPS proxy, enabling you to view in plain text the communication between web browser and SSL web server.

From https://www.charlesproxy.com/documentation/proxying/ssl-prox...

kiallmacinnes9y ago

A MITM proxy typically means a decrypting proxy, so you can see all the traffic, irregardless of if it's wrapped in TLS.

1 more reply

j / k navigate · click thread line to collapse