Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A proxy service for debugging HTTP/S traffic

debugproxy.com

Post reply on HN
Print view View original

41–44 of 44 posts

Re: Show HN: A proxy service for debugging HTTP/S traffic

#41

Post by tarnacious_ »

nnd wrote: post #39
mhils wrote: post #37

Earlier quoted context omitted.

This is true for the app store top 10, but from what I've seen not much out of that. In practical terms, the bigger problem is Android 8, which does not trust user-added CAs for app traffic ( https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm... ). It's a really odd move by Google against privacy researchers.

Weird, so much for a "hacker-friendly" operating system. I wonder if you can bypass this behavior by rooting the device?

If you have root access, you can [1]. You can also build your own apps to trust the "user" certificates [2].

[1]: https://blog.jeroenhd.nl/article/android-7-nougat-and-certif...

[2]: https://android-developers.googleblog.com/2016/07/changes-to...

Re: Show HN: A proxy service for debugging HTTP/S traffic

#42

Post by thatsheelpatel »

madeofpalk wrote: post #6
Matt3o12_ wrote: post #4

> debugProxy is a HTTP/S hosted proxy server that lets you interact with the traffic passing through it, using a web based dashboard. So, when I use your proxy you can see and store my http and https traffic (assuming I install the certificate in my device). Furthermore, all the traffic from the my pc to your proxy is also transmitted unencrypted so everyone who sits between my device and your proxy can see my traffi…

Also consider Charles, which is pretty nifty https://www.charlesproxy.com

Don't forget about Surge: https://nssurge.com

Re: Show HN: A proxy service for debugging HTTP/S traffic

#43

Post by [deleted] »

mhils wrote: post #37
nnd wrote: post #29

Earlier quoted context omitted.

Most of the popular consumer apps use SSL pinning these days.

This is true for the app store top 10, but from what I've seen not much out of that. In practical terms, the bigger problem is Android 8, which does not trust user-added CAs for app traffic ( https://github.com/mitmproxy/mitmproxy/issues/2054#issuecomm... ). It's a really odd move by Google against privacy researchers.

[deleted]
Post reply on HN