alt Hacker NewsThis has a big upside: I can now MITM any Android app / IOT device without any suspicious set up on the device? (given it'll run on the unupdated OS and that cert revocation is not ON).
Replies
eob • today at 1:00 PM
With the speed of vibe coding.. I'd expect the "Reverse Engineer Anything" folks to come out with a "Man in the Middle Anything" app by lunch
You also need to block access to the approved CT list until it fails open after 70 days.
This is assuming the CT logs no longer issue SCTs for these CAs. If they do then you just need to the CT dance and publish that certificate there.
Of course this assumes the app/device isn't using certificate pinning.