Access Tokens, Fiddler, Security

So it appears that my initial concern is moot. Agreed?

I can decompile your app, or attach a debugger at run time, and sniff the key that way.

With a temporary untrusted certificate, Fiddler can decode some SSL but from what I see, you can make it so your stream cannot be decoded this way and I was unable to use this technique to view, say an upload of files, the plain text.

With a temporary, untrusted certificate, Fiddler can decode *all* SSL unless the app is specifically looking for a pinned certificate.  Which means you need to do a lot more in your app than simply opening a connection.

See the following thread for info on cert pinning, and what certs to pin and what not to pin.

https://www.dropboxforum.com/hc/en-us/community/posts/203833895-Dropbox-Certificate-Chain-for-Certificate-Pinning-single-or-multiple-chains-

But pinning still doesnt get you around my first point.