Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Charles Proxy now available on iOS

charlesproxy.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: Charles Proxy now available on iOS

#71

Post by tzahola »

miles wrote: post #24

This is awesome! The first thing I discovered was how much network noise crashlytics.com was causing. Used AdBlock's[0] DNS proxy feature to black-hole the offending domain (they even mention blocking crashlytics.com in their FAQ[1]). Note that both AdBlock and Charlex rely on iOS's VPN feature, and only one can be enabled at a time. [0] https://itunes.apple.com/us/app/adblock/id691121579?mt=8http... [1] https://www.…

Hm, I thought Apple cracked down [0] on VPN-based adblockers. Or is AdBlock running a real VPN? I.e. your traffic goes through their servers.

[0] https://www.google.hu/amp/s/www.macrumors.com/2017/07/14/app...

Re: Charles Proxy now available on iOS

#72

Post by majewsky »

rimliu wrote: post #36
ReverseCold wrote: post #7

Earlier quoted context omitted.

This runs on the device itself.

And the desktop version allows to intercept the traffic of the machine it runs on. Mitmproxy cannot do that afaik.

What do you mean? This has been working since way before 1.0.

Re: Charles Proxy now available on iOS

#73

Post by huhtenberg »

simcop2387 wrote: post #35
yodon wrote: post #34

Genuine question here: How is it not absolutely terrifying that an iOS App Store app can man in the middle HTTPS communications made by other apps? Is there some way in which this isn’t poking a hole in exactly the sort of security sandbox that iOS tends to be good at? (And yes there probably is some part of what’s going on that I don’t understand, that’s why I’m asking the question)

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

> It's then able to install a CA root

Under what conditions does iOS allow an app to do this?

Re: Charles Proxy now available on iOS

#74

Post by hrrsn »

tzahola wrote: post #71
miles wrote: post #24

This is awesome! The first thing I discovered was how much network noise crashlytics.com was causing. Used AdBlock's[0] DNS proxy feature to black-hole the offending domain (they even mention blocking crashlytics.com in their FAQ[1]). Note that both AdBlock and Charlex rely on iOS's VPN feature, and only one can be enabled at a time. [0] https://itunes.apple.com/us/app/adblock/id691121579?mt=8http... [1] https://www.…

Hm, I thought Apple cracked down [0] on VPN-based adblockers. Or is AdBlock running a real VPN? I.e. your traffic goes through their servers. [0] https://www.google.hu/amp/s/www.macrumors.com/2017/07/14/app...

Looks like this app is the one mentioned in that article. They appear to do both Safari content blocking and use the VPN profiles to block DNS requests (as in no traffic hits their servers).

Re: Charles Proxy now available on iOS

#75

Post by hrrsn »

huhtenberg wrote: post #73
simcop2387 wrote: post #35

Earlier quoted context omitted.

Can't say much about the security, but I suspect it's working by pretending to be a VPN provider and then proxying the traffic. It's then able to install a CA root to generate any certs it needs to MITM traffic. Cert pinning will prevent this from working, but that's the only thing that will.

> It's then able to install a CA root Under what conditions does iOS allow an app to do this?

Apps can do this by presenting a configuration profile to the user. This requires entering the passcode and a few steps - it’s not something they can do silently.

Re: Charles Proxy now available on iOS

#76

Post by runeb »

hrrsn wrote: post #75
huhtenberg wrote: post #73

Earlier quoted context omitted.

> It's then able to install a CA root Under what conditions does iOS allow an app to do this?

Apps can do this by presenting a configuration profile to the user. This requires entering the passcode and a few steps - it’s not something they can do silently.

Also, after installing a certificate the user needs to explicitly go into Settings sub menus and toggle trust for that certificate.

Re: Charles Proxy now available on iOS

#78

Post by derwildemomo »

nick873s wrote: post #77

If you are a developer, consider the free alternative https://www.github.com/kasketis/netfox ;)

Came here to say the same thing: If you're interested in seeing the traffic caused by your own app (and also making that info accessible to other stakeholders during dev time), netfox is the way to go. Super easy to integrate and provides usually enough info. Also no tinkering with the system settings or third party apps required.

Re: Charles Proxy now available on iOS

#79

Post by theothertom »

cstrat wrote: post #60

I'm trying to get it to work but whenever I have the VPN enabled all network traffic fails (HTTP and HTTPS). Anyone else have this issue? The website isn't giving me much insight :( edit: I'm on the latest iOS beta. Could that be why? funny that I'm troubleshooting an app which is largely meant for troubleshooting apps...

I found that it didn't work on WiFi networks that block client-to-client connections, if that gives you any pointers.

Re: Charles Proxy now available on iOS

#80

Post by matthewmacleod »

feelin_googley wrote: post #12

Imagine if the user could compile their own kernels for iOS^W^W [edit] that can control an iPhone. She enables IP forwarding in the kernel configuration. Maybe she can also disable some crucial bits for interacting with the baseband. She only wants wifi to work. Then she uses this phone with the custom kernel (phone #1) as a gateway for another phone (phone #2). She can easily block ads and other undesired traffic de…

Sending all traffic over a VPN to a server of your choosing essentially accomplishes the same thing. It's true that there could be some kind of code in there that overrides this choice, but the implications would be pretty severe.
Post reply on HN