Apollo-CustomApiCredentials VS mitmproxy

Apollo still works perfectly if you sideload it: https://old.reddit.com/r/apolloapp/comments/14nzii3/how_to_c...

https://github.com/ichitaso/ApolloPatcher/releases/latest

https://github.com/EthanArbuckle/Apollo-CustomApiCredentials

Are you using this? https://github.com/EthanArbuckle/Apollo-CustomApiCredentials/

Artemis customizes the User Agent, doesn’t it? Or am I mistaken? I could swear that I read something you posted somewhere talking about Artemis regarding the user agent. If so, does it use the official Reddit app as the user agent, or perhaps Mobile Safari? I’m not entirely sure what it should appear as to be safe, but perhaps either a chosen (in settings?) or randomized web browser user agent seems like it would work. According to this on GitHub, “anyone trying to get the app running on their device with their own API key should also modify the redirect URL, and user agent being sent to Reddit”.

We have at least three working options to use Apollo nowadays but as pointed out here, besides CustomAPI for reddit and Imgur we should also: change redirect URL and user agent to prevent Reddit from just block every request with the "Apollo" word in it - a new tweak should so:

Using the ipa from here

A number of individuals are already using their private developer API key to use Apollo again. You can find a GitHub repository specifically created for that purpose here.

This statement gives a false sense of security. You can use a transparent proxy, like mitmproxy, to view HTTPS traffic - https://mitmproxy.org/. https://reedmideke.github.io/networking/2021/01/04/mitmproxy-openwrt.html

You'll need to install mitmproxy and set it up on your computer and iOS. I won't go into too much detail here on how to do this, but there are plenty of guides available. This is a pretty good one: https://nadav.ca/2021/02/26/inspecting-an-iphone-s-https-traffic/

TIL this goes back to 2006, how cool! We nowadays have a much simpler version as a mitmproxy example: https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad.... Although it obviously does not work as well anymore with everything being HTTPS nowadays (unless you trust the cert of course). :)

Perhaps you could have your device use a proxy that can do the HTTPS unwrap for you? https://mitmproxy.org/ maybe?

A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.