Sniffing Firebase network traffic with Charles on Android, not working...

[Kazim Baygan]

I have an Android app, with a Firebase backend.

I am passing sensitive data as part of the "child" path structure as follows:

Firebase ref = new Firebase("<FirebaseRootUrlForMyApp>").child("Sensitive").child("another key").setValue(whatever);

My main question is: Can someone sniff this information? Does 'sensitive' stuff become part of the URL or is it posted encrypted?

I tried to sniff it my self, using Charles proxy tool and I can not see a thing (other than auth login using SSL).

I am guessing all communication is happening at a socket level and not at http(s) level. Is this correct? If this is the case, I am guessing it is encrypted along the way.

Thanks for your help

Kaz

[Jonny Dimond]

Hi Kaz,

Firebase uses WebSockets under the hood and the server only accepts connections using TLS/SSL. Essentially Firebase connections cannot be sniffed and can be considered as secure as TLS/SSL.

Jonny