2

I'm writing a client to retrieve data from a server (not under my control) via https and that works fine.

What I want to do is make it so my request to the server cannot be sniffed by someone on the client's computer using Fiddler, etc. So is there any way to make the headers/url encrypted before they can be intercepted by Fiddler?

Gary Garygary
  • 141
  • 2
  • 14
  • 2
    [this](http://www.fiddler2.com/fiddler/help/httpsdecryption.asp) explains how Fiddler performs a man in the middle attack to decrypt HTTPS traffic. Maybe that can give you some ideas for how to thwart it. – mbeckish Mar 03 '13 at 02:01
  • Related: http://stackoverflow.com/q/10808930/21727 – mbeckish Mar 03 '13 at 02:08
  • 1
    If you don't trust the computer your code is running on, then you have a big problem. No kind of encryption of your communication will help, if the user can go and read (or even modify) your code. – svick Mar 03 '13 at 03:18

1 Answers1

4

My understanding of Fiddler is that stands in between the client and the server by posing as a proxy. You are correct, it looks like Fiddler has the ability to intercept HTTPS transmissions.

But, per Fiddler's documentation the certificate that Fiddler presents will not be trusted by your C# application. The C# application will throw a exception saying that it could not verify trust with the remote server. And no data will be transmitted.

If you're really paranoid, you can do what is called "certificate pinning" where your C# application will look for a specific certificate from the HTTPS server to ensure that it is the exact server you're looking for. Though, if the certificate were ever to change, you'd need to update your application.

EDIT: Rereading the documentation, Fiddler does provide a way for the certificate it uses to be trusted by Windows (and any ensuing applications using those trusted stores like Chrome and .NET). If that is done, your C# application would more than likely operate like normal with your traffic being completely visible to Fiddler. If you are worried about this for some reason, I would take a look into certificate pinning.

Steven V
  • 16,357
  • 3
  • 63
  • 76
  • OK, I should have said that Fiddler currently has no trouble reading the data I'm sending. The certificate pinning thing looks like the way to go. – Gary Garygary Mar 03 '13 at 04:17