3 ms·
Curious why you don't think this is a security flaw. Surely a browser failing to pin certificates would be a bad thing, no?
by bognition 10y ago
Curious why you don't think this is a security flaw. Surely a browser failing to pin certificates would be a bad thing, no?
- wepple 10y agobrowsers generally don't pin certs. there are methods to do it but everyone is scared to do it as it's a pretty quick way to DoS your entire user-base if you get it wrong. The intended design of PKI suggests that pinning should not be a thing. unfortunately PKI is broken and pinning is a 'patch' because it's too each to obtain a cert for a property you don't own (hi bluecoat)
- darklajid 10y agoThere are legitimate reasons to extend the trusted root certificates (notably: corporate deployments). Admitted, I cannot come up with a reason that has anything to do with Pokemon, but - in general I think this should be possible. Plus: Who do you want to protect and from whom? The only person able to make Pokemon Go (locally, on their phone) accept another certificate is by having full access to the phone in the first place. It's the user, 'hacking' his own device. If this leads to exploits on the Pokemon Go server for some reason, than _those_ are the problems. The communication between app and Pokemon Go server uses TLS, even if I spoof a certificate for my very own device. For me this is one of the examples of Raymond Chen's "If you're already on the other side of the hatch it isn't a security exploit", but I might absolutely fail to understand the risks of course.
- bognition 10y agowow, thanks for the reply. Although i'm not sure why my question was downvoted...