4 ms·

Certificate pinning is absolutely targeted at stopping the use of rogue root CA's installed in devices. OWASP does a pretty good job of covering the topic. ht

• zurn 11y ago
  You just linked to 20 screenfuls of text that explain pinning in general, without a single mention of "rogue". The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislation.
  • antocv 11y ago
    Lol, you already see where this is going "market requirements dictates backdoors everywhere!"
  • Excavator 11y ago
    Of course a system misbehaves if you use an (intentionally) broken application. That's a Google Chrome issue and not an issue with pinning.
    • zurn 11y ago
      You might have a point if Chrome hadn't been the first browser to implement pinning, therefore defining the concept in web context to a large extent. You may argue that this is is broken behaviour, but that's what pinning currently is in browsers. Seems it's this way in Firefox too ("pinning not enforced if the trust anchor is a user inserted CA, default" - https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...)