3 ms·
I keep hearing rumors that Apple and Google are going to require that app developers start pinning SSL certs as a security measure to help prevent the MITM cert
by michaelbuckbee 11y ago
I keep hearing rumors that Apple and Google are going to require that app developers start pinning SSL certs as a security measure to help prevent the MITM cert setup demonstrated here.
- maqr 11y agoFor if that happens, or just for general convenience: https://github.com/iSECPartners/ios-ssl-kill-switch https://github.com/iSECPartners/ios-ssl-kill-switch
- michaelbuckbee 11y agoInteresting! So in that case pinning would only help against upstream attacks in actual traffic - but would still allow for reverse engineering?
- maqr 11y agoYeah, as long as you have control of the device. That hack only works if you have root, which means you have to be jailbroken, and Apple is always trying to stop that. I keep a jailbroken device around specifically for disabling all SSL for debugging and dumping app binaries/assets. I wish they'd just let me buy the thing rooted like Google does.
- userbinator 11y agoAs long as you have control of the device, you can force it to do what you want by patching the code.
- wingerlang 11y agoHe is also using a jailbroken device, which means he could see the built NSURL request and whatnot anyway.