7 ms·
This is only a problem if a client application has a server certificate pinned in source code. Otherwise, you can create a cert with a privacy CA and add it to
by eightnoneone 2y ago
This is only a problem if a client application has a server certificate pinned in source code. Otherwise, you can create a cert with a privacy CA and add it to a desktop OS trusted cert store.
- K0nserv 2y agoAdding a CA cert to the OS trust store only works if the application uses it. I've encountered apps that don't use the OS trust store or networking stack; even then it's possible to reverse engineer the traffic though[0]. 0: https://hugotunius.se/2020/08/07/stealing-tls-sessions-keys-from-ios-apps.html https://hugotunius.se/2020/08/07/stealing-tls-sessions-keys-...