3 ms·
They could require a root ssl cert to be installed and then just MITM all the traffic. And Org that wants to protect personal data might be willing to do someth
by bhhaskin 9y ago
They could require a root ssl cert to be installed and then just MITM all the traffic. And Org that wants to protect personal data might be willing to do something stupid like that.
- equalunique 9y agoTrue. This is not hard to deploy if they leverage a centralized management solution for PKI, such as MS Active Directory.
- CoC_CRUSHER 9y agoOn Android, the default SSL client settings require the full chain. Simply installing a rouge ca cert won't work for most applications out-of-the-box. If you are interested in collecting the data sent by a particular application, you can patch the bytecode to override this behavior. This also works against cert pinning.
- revelation 9y agoFor a properly engineered mobile app there are only downsides to using the public CA system (and thereby the devices CA store). So that would not work.