Re:Facebook has been paying people to install a “Research” VPN
by dzhiurgis on Tuesday January 29, 2019 @11:10PM
(#19032572)
So what DOES pinning protect against? Certs generated by state actors with access to CA’s?
Re:Facebook has been paying people to install a “Research” VPN
by frankchn on Tuesday January 29, 2019 @11:12PM
(#19032585)
That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.
Re:Facebook has been paying people to install a “Research” VPN
by jevinskie on Wednesday January 30, 2019 @12:46AM
(#19032987)
You can enforce certificate pinning in your own native app. You can even go as far as not trusting the hookable (on a JBen device) system libraries and link in your own OpenSSL or something similar.
Re:Facebook has been paying people to install a “Research” VPN
by lol768 on Wednesday January 30, 2019 @04:25AM
(#19033747)
I was under the impression Chrome was dropping HPKP support (it was deprecated in 2017), so I imagine this would be across all products - desktop and mobile.
Re:Facebook has been paying people to install a “Research” VPN
by Leace on Wednesday January 30, 2019 @07:41AM
(#19034576)
Chrome is dropping support for dynamic HPKP pins (pins that sites can add via headers) but not for static pins (Google domains etc.)
Source: https://bugs.chromium.org/p/chromium/issues/detail?id=779166
> OK, we're looking at removing dynamic PKP in M69. Static PKP will remain until further notice (we have no active plans to remove it right now).
> Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.
http://www.chromium.org/Home/chromium-security/security-faq#...
EDIT: Spaced on the fact this is a phone app. While Chrome on Windows ignores certificate pins, I'm unsure if this also applies to Android / iOS root stores as well.