Hacker News Reader

To get a good idea of what they are doing, visit whatsmyudid.com and follow the instructions to use SuperUDID (you don’t need to go through with it, just read the steps).

Similar to SuperUDID, they installed a profile onto their device that provided special privileges for Facebook.

View on HN

This is actually not quite true. They only installed a signing profile, which still requires a prompt to install each app and wasn't used to do anything but install the research app. The "keys to the kingdom" is the trusted root certificate, which coupled with the VPN, made them your ISP and gave them complete access to all traffic in all apps.

I was showing how they would go about getting the trusted root certificate on the phone, which can be packaged with MDM profiles installed similar to the method used above.

Reply on news.ycombinator.com