Android: Prevent sniffing (e.g. with CharlesProxy) of SSL traffic

Question

I use Charles to check what data is sent, throw my application into HTTPS. I installed the Charles CA certificate on my phone, and because of this, I can decrypt every SSL traffic.

But I found applications where it is impossible to see SSL traffic. How can I implement this behavior in my application? Moreover, not a single person in an average attack will be possible.

Answer 1

... I installed the Charles CA certificate on my phone, and because of this, I can decrypt every SSL traffic.

But I found applications where it is impossible to see SSL traffic. How can I implement this behavior in my application? Moreover, not a single person in an average attack will be possible.

/ , , , . . OWASP.

Answer 2

Pinning - , , , . , , .

, , , - // , , .

, , , api, / .