Re:Kazakhstan to MitM all HTTPS traffic starting Jan 1
by KirinDave on Thursday December 03, 2015 @12:25AM
(#10667922)
Apps can certificate pin in 2 ways. One, they can directly inspect the certificate fingerprint and pin to a specific fingerprint (I chose this method for Level Money's product).
The other option is to examine and pin the signing certificate. This is more code and more prone to error, but makes your connection slighty more robus in the face of a compromised certificate.
And yes, both techniques work even if a cert in your root store has another certificate. Applications can simply refuse to function, but this has to be done on an ad hoc basis.
The other option is to examine and pin the signing certificate. This is more code and more prone to error, but makes your connection slighty more robus in the face of a compromised certificate.
And yes, both techniques work even if a cert in your root store has another certificate. Applications can simply refuse to function, but this has to be done on an ad hoc basis.