7 ms·
Would public key pinning stop the MITM of Google, even in this case?
by gengkev 10y ago
Would public key pinning stop the MITM of Google, even in this case?
- gruez 10y agoIn this specific implementaion, yes. But they had local code execution, so they could replace the executable with one that doesnt have the checks, or at least patch the code in-memory.
- ikeboy 10y agoThis is incorrect, at least for chrome: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq... Tl;Dr key pinning doesn't protect against local root certs.