Protect Android App against Network Sniffing

Question

I'm using Retrofit for making get/post requests to my app's web api.

I installed ssl on my server , so i can successfully connect my web api via https.

(Note : the ssl certificate is not self-signed.)

The weird thing is , you can capture get/post or other requests with this app : https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture

Also if you use http or https it does not matters.The "Packet Capture" app can capture all web request...

(You must install Packet Capture app's certificate on your device to work)

The question is ,

I want to protect my app against network sniffing , how can i do that ?

I'm using asp.net / iis 8 for web api if it matters

Answer 1

If you want your network traffic to be unreadable to others regardless of where they can look, you must encrypt and decrypt everything yourself in your own code and not rely on anything the operating system provides. Use a suitably strong encryption scheme.

This is only open to you because you control both the server and the client.