News for hackers. Stuff that matters.

A comment on Fun with your friend's Facebook and Tinder sessions. Parent comment

Re:Fun with your friend's Facebook and Tinder sessions by danielweber on Tuesday December 16, 2014 @08:58PM (#8760686)
In the story, BurpSuite was used only on the attacker's machine for ease of use. You could also hand-craft the requests using curl.

Cert pinning doesn't help when someone installs their own certificate authority. It stops other CAs that came bundled with the browser from working, but if it stopped self-installed certificates from working it never would have gotten off the ground because many organizations demand the ability to use their own certificates for signing things.

[ Parent | on HN ]
Re:Fun with your friend's Facebook and Tinder sessions by rjaco31 on Wednesday December 17, 2014 @05:57AM (#8761861)
Cert-pinning in the application for their own server is totally doable, that's exactly what Google is doing with Chrome.
[ Parent | on HN ]
Re:Fun with your friend's Facebook and Tinder sessions by danielweber on Wednesday December 17, 2014 @11:46AM (#8762922)
If you install your own CA into Chrome, it will overrule the cert-pinning that Chrome does. This is very on purpose.
[ Parent | on HN ]