Re:.INTERNAL is now reserved for private-use applications
by freedomben on Saturday August 10, 2024 @10:54AM
(#41209950)
They are certainly different things, but they're not unrelated. The inability of the user to change the system trust store is part of why certificate pinning is no longer (broadly) recommended.
[ Parent
| on HN ]
Re:.INTERNAL is now reserved for private-use applications
by Arch-TK on Saturday August 10, 2024 @08:59PM
(#41213279)
Certificate pinning is mainly an obstacle to using an intercepting proxy to inspect and modify the traffic of an application. If you're doing that kind of stuff you already know how to bypass the annoying OS level certificate store restrictions or how to modify an application to disable certificate pinning. The reason certificate pinning is no longer broadly recommended is because of how it makes it more difficult to rotate certificates in the case of necessity, and has nothing to do with the restrictions certain operating systems place on easy installation of your own certificates.