2

When I setup Charles for debugging, I can see all the traffic which is a good part. But Charles is showing all the traffic for my released production app which is not good at all.

Is there any way, I can stop Charles to capture all the traffic for my production app without SSL Pinning?

Please help me out.

Thanks in advance!

3
  • Hello @Sudha Tiwari have you found anything for the same? Commented Jun 27 at 9:24
  • @BhaveshLathigara no. :( Commented Jun 27 at 17:06
  • okay, thanks. @Sudha Tiwari Commented Jun 28 at 11:28

1 Answer 1

3

No - there's no way to do this, and actually even SSL pinning cannot guarantee this.

More generally: it is impossible to keep the details of what your application is doing on a user's device completely secret from the user, if they're sufficiently determined & knowledgeable. You can make it more difficult, but it's a cat and mouse game that you will never 'win'. At the end of the day, the user controls the device, not you.

In the simple case, they can just install their own certificate authority and then intercept traffic on the local network or similar. You can't defeat this without certificate pinning, and certificate pinning to block this will make your app unusable on many enterprise networks that require this kind of network scanning for all traffic.

In the more advanced case, they can use a jailbroken device, and then they can modify your app directly (either with Frida, or extracting the built app and modifying it themselves) so they can just disable any protections you add.

An app trying to defeat a user who fully controls the device is not possible, and not a good idea. Instead, you should ensure you don't have any critical secrets stored inside your app's source code or visible in the traffic, you should assume all traffic you send is visible to your users, and you should configure your server to not trust incoming app traffic by default.

If you use proper security mechanisms on the server, it shouldn't be a problem if users can see the traffic from their own devices. This is the same model that web pages have always worked with: they run in a browser (an untrusted environment where the user can see everything) but send traffic to a server, who authenticates requests.

5
  • 1
    but 'SSL pinning' do raise the difficultly of capturing the traffic using Charles
    – Wayne Mao
    Commented Jul 18 at 5:38
  • I mean it might raise difficult a tiny bit, but by maybe 10 minutes of effort (if you don't know what you're doing) or 10 seconds (if you do and you already have a setup ready). Additionally, your users should be able to see their own traffic! It's traffic happening on devices they own & control! They are in charge of their phones, not you. Regardless, there is definitely no world where you can really assume they can't, and since you have to defend your system against this anyway, you may as well skip adding pointless certificate pinning defences that won't work.
    – Tim Perry
    Commented Jul 19 at 12:58
  • I don't think only 10m can cross the 'SSL pinning'. To be honest, I don't even find a way to access the traffic if an app enabled 'SSL pinning' and only allow the sign of its own cert. I do make some effect but failed.
    – Wayne Mao
    Commented Jul 26 at 3:26
  • @WayneMao Lots of guides available with ready-to-use scripts, I wrote one here: httptoolkit.com/blog/frida-certificate-pinning
    – Tim Perry
    Commented Jul 27 at 12:09
  • The topic are good. But looks like it needs to root the android device. Also I hope there can be done on iOS...
    – Wayne Mao
    Commented Aug 17 at 4:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.