HTTP Toolkit Blog

https://httptoolkit.com also worth a look if you're interested in this space: has some neat automated setup for Android MITM that can be much simpler _and_ more effective than the manual config route (with automated Frida setup on rooted devices, so it handles unpinning too!). More UI & less CLI focused, so depends which way your preferences go there.

I know it's a separate tool, but HTTP Toolkit is great: https://httptoolkit.com/

I'd highly recommend https://httptoolkit.tech/ for that explorative GUI phase. I found it recently and the rule configuration, UI and interception setup is significantly better than Charles/Fiddler/Proxyman.

Have you ever tried HTTP Toolkit? See https://httptoolkit.tech/ (disclaimer: I'm the author) It quite a few features on top of the core MITM functionality, like automated setup for a bunch of use cases like browsers & Android interception (not Docker, yet, but it's coming!). If you're an avid mitmproxy user I'd love to know what you think.

I can add certificates on my unrooted android. That how HTTPToolkit [0] works, it only requires adb, which (thankfully) doesn't trip banking apps. Banking apps can (and do iirc) pin certificates, so a rooted phone adds no risk whatsoever. Also in my experience a rooted phone experience is by far more secure than the OEM androids. Security is supposed to assess risk objectively, yet "running on a Xiaomi phone with 3rd party apps that cannot be uninstalled and have system access" is somehow more secure than "running on a signed LineageOS where user can edit hosts file". [0] https://httptoolkit.com/

This one is truly a gem: https://httptoolkit.com It even bypasses SSL pinning on Android using 1 click.

For my rather simple needs I've been using https://httptoolkit.com free edition, I like that it launches a independent Firefox window on its own for the intercepting so I don't have to touch my working browser or deal with configuring a proxy anywhere

Just setup httptoolkit [0], it just works. [0] - https://httptoolkit.com/

Have a look at https://httptoolkit.com/ which works with a lot tools (even cli)

As usual, a thousand word essay on Google's WEI without ever mentioning that Apple sailed that ship silently a while ago, therefore not attracting any attention or backlash. https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ https://toot.cafe/@pimterry/110775130465014555 The sorry state of tech news / blogs. Regurgitating the same drama without ever looking at the greater picture.

previously it was titled SEARCH. I like query better personally, as it kind of aligns with SQL like requests. Here's a great post on it- https://httptoolkit.com/blog/http-search-method/ and earlier HN thread- https://news.ycombinator.com/item?id=36095032

Previously i had some success with this https://httptoolkit.tech/ and running the app on android emulator

1. MITMProxy[1] is scriptable (Python API) to modify requests/responses, or HTTP ToolKit[2] seems to be more on the non-code side (haven't used it). 2. Sure, but there's not much value in it. An API is the available contract for the communication between services. The server needs to guarantee it and the client can implement the needed parts. The client should implement solutions for server-side error cases either way, handle rate limiting, and send each request with a timeout. Everything else relies on the guarantee of the server, which, as the client, isn't your responsibility. 3. Only when i need a quick workaround for a feature the server doesn't provide (e.g. CORS injection) and maybe for test automation. [1] https://mitmproxy.org/ [2] https://httptoolkit.tech/

Same with Telerik Fiddler recently. Good piece of software for debugging network requests on Windows. Was free for as long as I've known it existed. Telerik recently bought by 'Progress' (ironic), software re-written in Electron and now charges a subscription to use it. Glad HTTP Toolkit is now available free for 'hobbyist' tasks - https://httptoolkit.tech/

Major war on general purpose computing vibes resumes 'It's in the users best interest to not let them bring their own computer & have to use a Google approved computer because [fill in corporate doublespeak bullshit here]'. Fwiw, the whole system of native apps have dealt with this hlkind of crap forever & it's expected. An old super small native app we had failed pen testing because it would run on jailbroke devices. Google Play SafetyNet and probably three other frameworks on Android all exist to make sure users don't have ownership of devices. So this is basically a Google Project Fugu effort, but the dark side. the web should be capable of doing everything native apps do, even when that thing is placing a huge boot on the face of users & rejecting their user-agency. Womp womp. Also, notably, Apple already shipped a just as bad implementation of PrivateTokens where websites can ask Apple to make sure the device is legitimate. I'm not sure why Google built a new spec, why they decided to be a huge lightning rod for this, a lightning rod with much less cover from publicity, as instead of being a generic attestation system (and relying on Apple having dominion over their platform in a way Android lacks), it's a very narrow attestation system about device integrity. https://httptoolkit.com/blog/apple-private-access-tokens-attestation/

How does it compare with https://httptoolkit.tech/

> One of the issues I found with http clients I looked into is that they often don't provide enough functionality to hook into the request process. Either before or after a request is executed to add to the headers or parameters of the request or getting the results of the request. I find that httpkit (or just mitmproxy) often gives me decent insight to the actual requests. I don't know about altering requests "in flight" - I typically re-issue the request via curl or my application server (eg: rails console or debugger breakpoint). Strongly considering purchasing httpkit - but so far I've just needed it occasionally. I feel like postman etc is closer to println Debugging, while just intercepting the traffic is more like using a real debugger. But I guess I can see why some like postman etc for exploration - so far i prefer swagger for that (or soapui for xml/soap - preferably running soapui under httpkit for the best of both worlds). https://httptoolkit.tech/

https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ Also, Apple sells themselves as a privacy company, but often pick (possibly intentionally) insecure defaults. E.g. you might use end-to-end encrypted chats, but by default iCloud backups are not end-to-end encrypted, so law enforcement can just request your backups/chats from Apple. If you are vigilant and enable Advanced Data Protection for E2E iCloud backups, it probably still doesn't matter because the people that you communicate with probably do not have ADP enabled. Besides that, they are enshittifying in the same way as Google. Ads in Maps, Ads in applications that you get with the OS (Apple Creator Studio ads in Keynote, etc.), Ads in your system settings for Apple Fitness+ (really). At least Pixel phones and soon some Motorola models have the option of installing GrapheneOS.

Apple has device attestation deployed like one year before Google even proposed it: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/

Clients are supposed to check. For example, Apple requires a varying number of SCTs in order for Safari to trust server certificates. https://support.apple.com/en-us/103214 And yes, it does break MITM use cases, for example on Chrome: https://httptoolkit.com/blog/chrome-android-certificate-transparency/

> Free > Privacy-focused > GitHub (Microsoft) > Cloudflare Which is it? These US megacorporations are respecting neither users’ privacy nor their freedom. https://mako.cc/writing/hill-free_tools.html https://httptoolkit.com/blog/public-cdn-risks/ Also not to be confused with PRISM Break <https://prism-break.org/>

There's also certificate pinning which is done by basically every modern android app so you often need to modify apk to remove that. Httptoolkit has a good blog on the process: https://httptoolkit.com/blog/frida-certificate-pinning/

Isn't this outdated information? https://httptoolkit.com/blog/public-cdn-risks/ > Most importantly: cached content is no longer shared between domains. This is known as cache partitioning and has been the default in Chrome since October 2020 (v86), Firefox since January 2021 (v85), and Safari since 2013 (v6.1). That means if a visitor visits site A and site B, and both of them load https://public-cdn.example/my-script.js, the script will be loaded from scratch both times.

WebAuthn doesn't work the way you think it does. Most computers don't have fingerprint readers or even webcams, let alone webcams capable of verifying a user. Instead, you'll end up making people type in their Windows password or scanning QR codes. Remote attestation concepts already exists to solve this problem: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ Cloudflare ran an experiment with it, and I think Apple and Cloudflare are working to make it into a proper RFC. It's only a matter of time before other browsers will support it too with the way things are going right now.

Even if the web developed effective single sign-on payment solutions, it would make utterly no difference for iOS, since Safari would never support the same. You can easily bet your life, that Apple would reject this or only maliciously comply. https://httptoolkit.com/blog/safari-is-killing-the-web/

Not only. Example: Chrome on Android did change some time ago so if CA is in System store (which means it got here from manufacturer or from user which does have root access) - such CA MUST use Certificate Transparency. This rule doesn't apply if CA is in User store (installable by regular user) - https://httptoolkit.com/blog/chrome-android-certificate-transparency/ Another example: Yandex Browser ONLY trust Russian NUC certs if they are in public CT logs,not otherwise (https://habr.com/ru/companies/yandex/articles/667300/ - text is in Russian) (as far as I understood, NOT trusting this CA al all is not option for them or their users, and if user is using chrome/firefox and needs access to sites which use this CA - CA will be just be installed manually so Yandex's solution is more secure, thanks to CTs).

And from Android 14 - adding a system CA certificate is a nightmare: https://httptoolkit.com/blog/android-14-install-system-ca-certificate/

There's some interesting information in that thread. Looks like Apple shipped their own WEI already and apparently nobody is talking about it. https://httptoolkit.com/blog/apple-private-access-tokens-attestation/

> making it trusted locally That is precisely the problem. Most proprietary systems don't let you touch the trust store at all. Even "open" platforms like Android have been locking down the ability to do anything to the trust store.[1] With that said, if we assume the user is only using Google Chrome and not an alternative browser, then typing "thisisunsafe" on the TLS error page should let one elide trust store modifications entirely. I cannot guarantee this is the case for HTTP/3 since the reverse proxies I deal with still use HTTP/2. [1] https://httptoolkit.com/blog/android-14-breaks-system-certificate-inst…

Their "ecosystem" model is why we need crowbar legislation like Europe's DMA to force interoperability. Make no mistake, Apple is playing for keeps just as hard as Google is: https://httptoolkit.com/blog/apple-private-access-tokens-attestation/ All of these companies deserve their due scrutiny. Specifically around the illusion of privacy though, nobody has further to fall than Apple.