{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/flipper/issues/233","repository_url":"https://api.github.com/repos/facebook/flipper","labels_url":"https://api.github.com/repos/facebook/flipper/issues/233/labels{/name}","comments_url":"https://api.github.com/repos/facebook/flipper/issues/233/comments","events_url":"https://api.github.com/repos/facebook/flipper/issues/233/events","html_url":"https://github.com/facebook/flipper/issues/233","id":350923192,"node_id":"MDU6SXNzdWUzNTA5MjMxOTI=","number":233,"title":"What value does the certificate exchange add?","user":{"login":"yschimke","id":231923,"node_id":"MDQ6VXNlcjIzMTkyMw==","avatar_url":"https://avatars1.githubusercontent.com/u/231923?v=4","gravatar_id":"","url":"https://api.github.com/users/yschimke","html_url":"https://github.com/yschimke","followers_url":"https://api.github.com/users/yschimke/followers","following_url":"https://api.github.com/users/yschimke/following{/other_user}","gists_url":"https://api.github.com/users/yschimke/gists{/gist_id}","starred_url":"https://api.github.com/users/yschimke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yschimke/subscriptions","organizations_url":"https://api.github.com/users/yschimke/orgs","repos_url":"https://api.github.com/users/yschimke/repos","events_url":"https://api.github.com/users/yschimke/events{/privacy}","received_events_url":"https://api.github.com/users/yschimke/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-08-15T18:51:27Z","updated_at":"2018-08-16T11:29:17Z","closed_at":"2018-08-16T11:09:09Z","author_association":"NONE","body":"Reading https://fbflipper.com/docs/establishing-a-connection.html\r\n\r\n> To avoid mobile apps from connecting to untrusted ports on localhost, they will only connect to servers that have a valid, trusted TLS certificate. In order for the mobile app to know which certificates it can trust, it conducts a certificate exchange with the desktop app before it can make its first secure connection.\r\n\r\nI'm confused about the real value of certificate exchange here.  The mobile apps connect to localhost, so assumes a process or at least a network tunnel on the host computer that can also use `adb`.  At this point any process running on the host computer that could run adb commands could pretend to be the flipper desktop app.\r\n\r\nIt would make more sense if this exchange then allowed remote connections to work, e.g. to a phone that was previously connected via USB, and is now just on the same Wifi network.  e.g. the exchange could also provide the local network address other than 127.0.0.1, e.g. 192.168.1.44."},"comment":{"url":"https://api.github.com/repos/facebook/flipper/issues/comments/413514102","html_url":"https://github.com/facebook/flipper/issues/233#issuecomment-413514102","issue_url":"https://api.github.com/repos/facebook/flipper/issues/233","id":413514102,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMzUxNDEwMg==","user":{"login":"jknoxville","id":692011,"node_id":"MDQ6VXNlcjY5MjAxMQ==","avatar_url":"https://avatars3.githubusercontent.com/u/692011?v=4","gravatar_id":"","url":"https://api.github.com/users/jknoxville","html_url":"https://github.com/jknoxville","followers_url":"https://api.github.com/users/jknoxville/followers","following_url":"https://api.github.com/users/jknoxville/following{/other_user}","gists_url":"https://api.github.com/users/jknoxville/gists{/gist_id}","starred_url":"https://api.github.com/users/jknoxville/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jknoxville/subscriptions","organizations_url":"https://api.github.com/users/jknoxville/orgs","repos_url":"https://api.github.com/users/jknoxville/repos","events_url":"https://api.github.com/users/jknoxville/events{/privacy}","received_events_url":"https://api.github.com/users/jknoxville/received_events","type":"User","site_admin":false},"created_at":"2018-08-16T11:29:17Z","updated_at":"2018-08-16T11:29:17Z","author_association":"CONTRIBUTOR","body":"I would agree that it effectively obfuscates getting access to the server, but this isn't a goal of the system.\r\nThe goal is to stop unintended access to the app you are debugging - with the exchange, this is possible only with an adb connection, as opposed to just needing to execute a process on the phone."}}
{"actor":{"display_login":"jknoxville"}}