I'm making an iPhone app that will communicate with my server over HTTPS. Important authentication information that is programmed into the app (for accessing app-specific content) will be sent to the server. If someone creates a fake SSL certificate that is installed on their device (the certificate looks like it is from my website) and points my domain name to their computer's IP address, is it possible for them to capture the authentication information and any other information that is initially sent to the server? Thanks for your help.
This question would probably be better asked over on IT security (you would have to give a bit more information on the predicted attack vector though).
Generally speaking if someone forges (a) the IP of your host, and (b) a certificate that your application finds acceptable - Yes. They can capture anything sent over that connection.
This is part of why you should not encode sensitive authentication information in your application.
The user's machine is a hostile environment. Do not trust them with anything sensitive.
|show 1 more comment|