Home Forums Reply To:

#363257

ng1905

You just thought about an evil twin attack.

>But with somes methods that I won’t explain here, you can bypass this.

As another user already said, you’re thinking about installing a root ca. That’s also nothing new and while I appreciate the thought, it’s nothing that “you can bypass”. Not only do you have to present the certificate to the user, he also has to ignore several warning signs (on Android/iOS) from entering their pin code or using biometrics to ignoring the security warning. AND EVEN IF THEY DO THAT most apps I know WILL FAIL with a certificate trust error (certificate pinning). And you can be sure that the user will turn off their WiFi once it doesn’t work.

So no, you can’t “sniff all network connections” with a fake AP and even if you get a user through the hassle of installing a certificate, you still won’t be able to sniff *all* network connections.