Re:Kazakhstan to MitM all HTTPS traffic starting Jan 1
by Excavator on Thursday December 03, 2015 @12:26PM
(#10670923)
Of course a system misbehaves if you use an (intentionally) broken application. That's a Google Chrome issue and not an issue with pinning.
Re:Kazakhstan to MitM all HTTPS traffic starting Jan 1
by zurn on Friday December 04, 2015 @01:39AM
(#10675025)
You might have a point if Chrome hadn't been the first browser to implement pinning, therefore defining the concept in web context to a large extent.
You may argue that this is is broken behaviour, but that's what pinning currently is in browsers. Seems it's this way in Firefox too ("pinning not enforced if the trust anchor is a user inserted CA, default" - https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...)
The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislation.