quellish

Los Angeles, CA

9h
comment iOS 8 CoreData Issue: recordChangeSnapshot:forObjectID:: global ID may not be temporary when recording
At any point are you using performBlockAndWait? And please in your question show how you are creating managed objects. If you are attempting to create them independent of a context, this is one of the many problems you may encounter.
13h
awarded Revival
2d
awarded Good Answer
Oct
17
answered Is a manual save required for when overrideing resolveConflicts in NSMergePolicy?
Oct
17
comment Can I use HTTP caching with an NSURLSessionDownloadTask on iOS?
Oh ya, you should file a bug on this, and potentially feedback on the documentation - if the session ignores your cache policies, that should be reflected in the documentation
Oct
17
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
OK, based on your comment your new question seems to be wether OAuth provides sufficient protection for your needs. It would be best to submit that as a new question where it can get the attention it deserves.
Oct
16
comment Why is XCode flaky about throwing duplicate symbol errors?
Can you update your question with a build log from a build where you see this behavior, and one where you do not?
Oct
16
comment iOS UI Automation
Your question is not very clear. Are you trying to run an automation script, period? Or are you trying to trigger UIAutomation from Xcode? Or do you mean to run the UIAutomation script from an objective-c application?
Oct
16
comment What are the Best Practices for Cache And Syncing in iPhone
"takes in Memory as a complete object space". Core Data gives you full control of the size of the in-memory object graph.
Oct
16
answered How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
You brought up foolproof, not me. "I do not see evidence that supports that pinning can be used to prevent the sniffing of https traffic". If pinning prevents a connection from being made, there is no content to sniff. Pinning is a well accepted best practice.
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
I can say with a high degree of certainty that recent versions of Facebook did not correctly implement pinning (but at one point, they tried!). I do no have specific knowledge of the other applications listed.
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
I said that an iOS application that correctly implements pinning CAN be made foolproof in securing the content of communications over SSL/TLS. What was ambiguous about that?
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
Yes. "use a specific certification and thus prevent the user from using installed certs." Pinning is checking the certificate provided by the remote host against a whitelisted value known to the client. It does not prevent the user from using the "installed certs". It performs a specific type of trust evaluation against a value known to the application. Pinning, for the purposes of making the content of the transport used by an iOS application immune to interception, CAN be made foolproof - though that is beyond the scope of his question.
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
Again, some of those applications use pinning, which would be an "active protection". The OP is asking how to protect himself from MITM attacks. If you believe this is impossible, say so. If you believe he cannot see the traffic because of his proxy configuration, be explicit - but still offer correct guidance on how to prevent MITM attacks. Your statement "detects that the certificate is not trusted by the system" ignores pinning.
Oct
16
comment Clear memory in NSManagedContext (release memory after creating)
Core Data manages the memory used by the object graph by using a concept called "faulting". Your application is in complete control of what is faulted and what is not. developer.apple.com/library/ios/documentation/Cocoa/Conceptual/…
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
The OP says he wants to protect his application in the same way. Nothing in his question indicates he thinks this will reduce his attack surface to 0. Nonetheless, if his application implements pinning correctly, there is no traffic content to sniff.
Oct
16
comment Sending Device Token Safely for APNs
SSL pinning is matching the credentials provided by a host against an expectation. The client checks the certificate the remote host provides, and if it does not match the expected value the client aborts the connection. There is no traffic to sniff beyond that point. See: owasp.org/index.php/…
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
And the SO answer you are pointing to is also incorrect :( That is not how SSL pinning works. See the tech note and WWDC 2014 session 704 for an explanation. developer.apple.com/videos/wwdc/2014/#704
Oct
16
comment How Facebook, SnapChat, or Gmail iOS apps prevent Fiddler decrypting their https traffic?
If you modify the cert chain, correctly implemented pinning will not be sniffable - the client will not connect to the untrusted host. Modifying the certificate chain isn't terribly difficult. At what point did I say "you can protect your app 100%"? I said your assertion that "you can't protect your own app" was incorrect. You can. You can be strict in your trust evaluation, and not allow your app to connect to untrusted hosts. It's up to you to determine what to trust, regardless of the trusted roots on the device. If the remote cert is not the cert you expect, abort. That is SSL pinning.
1 2 3 4 5