Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Charles Proxy now available on iOS

charlesproxy.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Charles Proxy now available on iOS

#61

Post by jmiserez »

bigiain wrote: post #37
nstj wrote: post #30

Earlier quoted context omitted.

Well, the certs don't _have_ to be shipped with the app, there are workarounds to refresh the certs without sending out a whole new app binary.

Yep - but guess what wasn't done in this case... (Yes, this is a still-trying-to-fix-it real world event... Glad it's not my problem, just one I hear about from people I used to work with...)

If you do pinning, you could just as well use a self signed cert for your API and pin that. If your API is not just used for the app, add a private proxy/load balancer that uses your pinned cert.

Re: Charles Proxy now available on iOS

#63

Post by saagarjha »

ce4 wrote: post #44
saagarjha wrote: post #26

Earlier quoted context omitted.

I've never done this personally, but I'm pretty sure there is no way to protect against hooking and/or patching functions in Secure Transport (iOS's low-level TLS stack), since all network traffic goes through these APIs. I'm sure there's something similar in Android.

You're not forced to use system facilities for TLS on Android. Back when you needed up to date TLS support for your app on older Android versions you would use e.g. BouncyCastle instead of the system's TLS facilities. Probably the same for iOS.

So just figure out which library they’re using and patch that.

Re: Charles Proxy now available on iOS

#64

Post by tinus_hn »

yodon wrote: post #38
simcop2387 wrote: post #35

Earlier quoted context omitted.

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

Supposed sandboxing against malicious apps is precisely why I run iOS rather than Android. I get that Charles isn’t malicious, but what’s keeping any random free game app from doing the same thing? (Again, intended as a real question not a rhetorical one)

The documentation states you have to follow the instructions to install the certificate manually which is what I would expect.

You can also click a link to a certificate on a webpage and install it manually on iOS.

Re: Charles Proxy now available on iOS

#65

Post by tinus_hn »

saagarjha wrote: post #20
nstj wrote: post #15

Sucks that more and more 3rd party apps are adding pinning to their code so you can't sniff their traffic. This is a great tool for first party debugging though :) Nice work Charles!

Of course, pinning is trivially defeated if you have debug-level access to the app because you could just intercept any network call.

That gives you the same access as full control over the network. You still can’t make the app believe it has a connection encrypted using a specific certificate.

Re: Charles Proxy now available on iOS

#66

Post by tinus_hn »

saagarjha wrote: post #31
nstj wrote: post #29

Earlier quoted context omitted.

Sure, but then you'd have to JB the phone. Most of this stuff is pretty straightforward, but not exactly 'trivial' - especially given the context is an iOS app specifically aimed at making MITM easier.

Certificate pinning is inherently security by obscurity; it's intended as an annoyance for anyone trying to reverse-engineer the service, rather than an insurmountable barrier.

It’s intended against a rogue CA supplying certificates for a service they shouldn’t be supplying certificates for.

For instance if a CA gives a CA certificate to a government running an SSL inspection service.

Re: Charles Proxy now available on iOS

#68

Post by manmal »

evan_ wrote: post #9

I use the desktop product daily so I picked this up. I frequently proxy my phone through my desktop but I figured this would be fun to play with if nothing else. I turned it on for literally one second and the first thing it captured was traffic from an app I used briefly several years ago and not since. Cool!

That sounds like a great tool for enhancing battery life, if you delete all the „overzealous“ apps.

Charles could show a list of recommended apps to delete.

Re: Charles Proxy now available on iOS

#69

Post by dorian-graph »

olliepop wrote: post #4

Charles can already be used as an http/https proxy on iPhone via https://www.charlesproxy.com/documentation/faqs/using-charle... I generally would only be needing to inspect requests when developing at my workstation, so how is this native app providing additional value beyond what the Charles Mac software already provides? Big fan of Charles over here, I just don't understand the use case for the native app.

> I just don't understand the use case for the native app.

You can watch his presentation [1] (which is linked to in the announcement page that story links to) for a few of the use cases.

[1] https://www.youtube.com/watch?v=RWotEyTeJhc

Post reply on HN