Re:MITM on HTTPS traffic in Kazakhstan
by dsl on Thursday July 18, 2019 @04:41PM
(#20473728)
> Cert pinning does mitigate it for apps, doesn't it?
Applications where the developer has pinned to their own certificate will stop this attack.
Chrome and Firefox will ignore pinning for locally installed CAs. This is a very common use case in the enterprise where, for example, a bank has audit requirements to decrypt and store all workstation traffic.
Re:MITM on HTTPS traffic in Kazakhstan
by PeterisP on Thursday July 18, 2019 @07:49PM
(#20475085)
It'll "stop this attack" by ensuring that the app won't work through the MITM - so it won't be able to connect from any Kazakhstan users unless/until the pinning is removed.
Applications where the developer has pinned to their own certificate will stop this attack.
Chrome and Firefox will ignore pinning for locally installed CAs. This is a very common use case in the enterprise where, for example, a bank has audit requirements to decrypt and store all workstation traffic.