News for hackers. Stuff that matters.

A comment on Advice to avoid public Wi-Fi is mostly out of date. Parent comment

Re:Advice to avoid public Wi-Fi is mostly out of date by lxgr on Thursday January 30, 2020 @01:07PM (#22193626)
As far as I understand, this is no longer possible on modern iOS versions at least, except if the app developers explicitly disable that validation.
[ Parent | on HN ]
Re:Advice to avoid public Wi-Fi is mostly out of date by RKearney on Thursday January 30, 2020 @03:21PM (#22195116)
You can pin your certificate in your app bundle such that your app only allows certificates you specify or ones signed by CA's you specify. That clearly isn't the case here. Normal iOS operation will verify the certificate chains up to a trusted root certificate and it is indeed possible to load your own trusted root CAs on to a device for purposes of MITM. Again, some apps may pin their own certificates, but that clearly wasn't happening in this example.

I deal with this virtually every day.

[ Parent | on HN ]