5 ms·
will certificate pinning flag anything if the user installs a new root cert on their device?
by anontestuser234 10y ago
will certificate pinning flag anything if the user installs a new root cert on their device?
- trakout 10y agoTypically the app that uses certificate pinning will just cease to use data during a typical mitm attack. Kind of like going into airplane mode.
- JonathonW 10y agoThat depends. I'm not sure what iOS or Android do here, but Chrome (as an example, since its behavior is well-documented) does not perform pin validation when the presented certificate chains up to a private trust anchor (i.e. a user-installed root cert) [1]. This was a deliberate choice on the part of the Chrome team, to allow this type of MITM (presumably because it's not uncommon in enterprise environments). [1] http://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- http://www.chromium.org/Home/chromium-security/security-faq#...