keyring VS mitmproxy

pi@raspberrypi:/etc $ pip show keyring Name: keyring Version: 23.13.1 Summary: Store and access your passwords safely. Home-page: https://github.com/jaraco/keyring Author: Kang Zhang Author-email: [email protected] License: Location: /usr/local/lib/python3.9/dist-packages Requires: importlib-metadata, jaraco.classes, jeepney, SecretStorage Required-by:

There were 2 major pain points for me:

* USB access is more difficult than just plugging something in.

* Debugging tools like perf, RR, etc were either unsupported because they needed hardware counters or custom builds (no system headers in apt to help either).

* The VM takes a lot of disk space.

The rest of the experience was fairly smooth. WSL2 can access the entire filesystem through /mnt//. Windows -> WSL is a bit janky, but it works. GPU access is supported. Network access works. You can use a remote X session to get GUIs working, though you need to be comfortable with linux. Unfortunately having DISPLAY set caused pip to hang for long periods due to [1], but apparently that's been resolved.

[1] https://github.com/jaraco/keyring/issues/531

I used the keyring command which stores credentials securely in macOS keychain or Windows credential locker, etc. but you could also have it read a text file stored in a secure location of something else, lots of ways to do it

This statement gives a false sense of security. You can use a transparent proxy, like mitmproxy, to view HTTPS traffic - https://mitmproxy.org/. https://reedmideke.github.io/networking/2021/01/04/mitmproxy-openwrt.html

You'll need to install mitmproxy and set it up on your computer and iOS. I won't go into too much detail here on how to do this, but there are plenty of guides available. This is a pretty good one: https://nadav.ca/2021/02/26/inspecting-an-iphone-s-https-traffic/

TIL this goes back to 2006, how cool! We nowadays have a much simpler version as a mitmproxy example: https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad.... Although it obviously does not work as well anymore with everything being HTTPS nowadays (unless you trust the cert of course). :)

Perhaps you could have your device use a proxy that can do the HTTPS unwrap for you? https://mitmproxy.org/ maybe?

A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.