3 ms·
Not really, heck, on Android and iOS around 40% of banking apps don't even check the certificate at all. Most people, even most developers seem to be pretty cl
by ultramancool 11y ago
Not really, heck, on Android and iOS around 40% of banking apps don't even check the certificate at all.
Most people, even most developers seem to be pretty clueless with this stuff.
- yrro 11y ago> on Android and iOS around 40% of banking apps don't even check the certificate at all. Please name and shame, this sounds pretty surprising!
- ultramancool 11y agoHeard that on an old security now episode, https://www.grc.com/sn/sn-443-notes.pdf https://www.grc.com/sn/sn-443-notes.pdf is the best I have unfortunately, there's mention of it near the bottom there.
- unluckier 11y agoAt least for Android: https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?pli=1#gid=1053404143 https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w... There are several banking-related apps listed here.
- sprkyco 11y agoList of Android SSL MITM vulnerable apps: https://samsclass.info/128/proj/popular-ssl.htm https://samsclass.info/128/proj/popular-ssl.htm Highly recommend any material on the main site as well. One of the few legit infosec professors I have ever interacted with.
- jacobwil 11y agoThe paper won't be available to everyone until Wednesday at [1], but: > Altogether, of the 639,283 [Android] apps in our data-set, 45 implement pinning. [1]: https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/oltrogge https://www.usenix.org/conference/usenixsecurity15/technical...