This is specifically to prevent mitm attacks on the app.
You have to get the APK and mess with the manifest to bypass that. And bypassing pinning is even more difficult.
Edit: pimterry below me explains it better: https://news.ycombinator.com/item?id=27857429
I find this a problem because MITM isn't always bad. It can be used for inspecting apps for tracking and other malicious practices by app makers.
I was unaware of this as I do little interaction with Android. TIL.
And yes, I do appreciate being able to MITM all kinds of apps, especially ones that talk to a device I own to be able to add functionality/integrations not supported by the manufacturer.
I also see the benefit of preventing MITM, in our case, it is because we intentionally offload logic onto the client to simplify GDPR/CCPA compliance(can't store what you don't collect) among other design decisions which mean a malicious client could circumvent rulesets we have in place.
Note that your HTTP certificate pinning is easily bypassed on both Android and iOS by a determined actor. A malicious client will circumvent rulesets you have in place. If you do not validate client inputs, you will be exploited.
Indeed, it doesn't really differ that much from DRM. It's an attempt by the author of the software to impose control over the user, preventing them from using the software how they see fit.
If I've trusted my own root, and you've decided you wont trust anything on my root, I now need to take steps to disable the certificate validation routines completely on my device, in order to bypass your restrictions.
I get that there are cases where it's extremely valuable (and in some cases, required by regulators) to enforce certificate pinning, e.g. mobile banking apps, but there are plenty of cases where it's just bullshit DRM (e.g. gym app that performs unauthenticated requests to an https endpoint to retrieve occupancy stats on each of the chain's gyms).
In the latter case, all I wanted was to track how busy the gym was over time, so I could adjust my schedule to enable me to go when the gym was quiet. I couldn't be bothered to jailbreak my iphone and install nabla-c0d3/ssl-kill-switch2, so instead I quit my gym and switched to one that was less stupid.
I agree. That is why there is still serverside enforcement, but performance tuning is heavily cache based and many client request strategies are specifically designed to not bust the cache and cause a high latency call.
Also, in our case, the app is the product. I'm not very positive on it's market fit, so you may never hear of it if it launches to a fizzle, as I suspect is a large probability.