Mobile Networking · Watching Traffic · Lesson 4 of 4

Spotting Leaky Apps

Spot the signs of an app that sends too much, or sends it unprotected.

Signs of a leak

A leaky app sends out more about you than its job needs, or sends it in an unsafe way. With a proxy on your own test phone, you can look for the common signs:

• Personal data in URLs. Query strings often get saved in server logs and other records, so an email address or token in a URL can turn up in places nobody intended.
• Identifiers sent to third parties. The weather app's POST to analytics.tracker.example carried a device ID. That lets a tracking company link your activity over time.
• Precise location where a city would do. A forecast doesn't need your exact GPS position.
• Anything over plain http://, which you'll look at next.

The standard for bearer tokens says they shouldn't go in page URLs, because browser history and web server logs may not keep URLs safe. Headers are the right place.

If you find a leak in an app you don't own, report it to the developer privately, through its security contact or bug bounty program. Never use it to reach anyone's data.

The plain HTTP red flag

The proxy log had one request that began with http://, with no s. That request had no encryption at all. The proxy could read every byte, and so could the café Wi-Fi owner from the first module, or anyone else on the path. They could even change it along the way, swapping in a fake image or a different download.

Unencrypted traffic is called cleartext, and both phone systems now push hard against it. On Android, apps that target Android 9 or newer have cleartext traffic blocked by default, and a developer has to switch it back on in the app's Network Security Config. On iPhone, a feature called App Transport Security has blocked plain HTTP by default since iOS 9, unless the app declares an exception.

So when you see http:// in a modern app, someone made a choice. Sometimes it's harmless, like a public image. If it carries logins, personal details or app updates, it's a real leak worth reporting.

Type the one-word term both systems use for unencrypted traffic.