News for hackers. Stuff that matters.

A comment on How Airlines don’t care about privacy: Case Study Emirates.com. Parent comment

Re:How Airlines don’t care about privacy: Case Study Emirate... by seanmcelroy on Sunday March 04, 2018 @07:12PM (#16517678)
HPKP is what the article you posted to is referring to, and probably will go away completely.

However, profiling the public key of the site a mobile app connects to and erroring out if it is compromised to prevent MitM attacks is called 'certificate pinning' for mobile apps but is not related to the HPKP pinning of browsers. A reference for certificate pinning: https://blog.netspi.com/certificate-pinning-in-a-mobile-appl...

[ Parent | on HN ]
Re:How Airlines don’t care about privacy: Case Study Emirate... by asterius on Sunday March 04, 2018 @07:49PM (#16517858)
It seems grandiose to call that 'certificate pinning' when it is just hard coding, e.g. a self-signed CA cert or (worse) a particular server cert.

Makes me suspect that a lot of client side validation is happening with mobile apps.

[ Parent | on HN ]