3 ms·
That's Option 1. In Option 2, Moxie suggests using the Web PKI, with pinning. I agree with tialaramex that this advice has not aged well. Most Web PKI expert
by agwa 9y ago
That's Option 1. In Option 2, Moxie suggests using the Web PKI, with pinning. I agree with tialaramex that this advice has not aged well. Most Web PKI experts would now advise against pinning and point to Certificate Transparency instead. Even Google, the pioneers of pinning that Moxie cites in his post, are moving away from pinning Google properties in Chrome.
- tptacek 9y agoYou're still talking about browsers. Moxie isn't: he's talking about mobile applications. There is little reason to rely on CAs, even with pinning, in a mobile application. You can simply make your own arrangements with your servers, since you control both ends of the connection. In that scenario, CAs add literally no value at all.
- shawkinaw 9y agoExcept that, IMO, I should be able to MITM the connection between an app on my phone and any server it’s talking to, for auditing purposes. In that case, CA/system trust-based systems let me do that relatively easily with a proxy. If the app sets up its secure connection with its own, uncustomizabe trust store, I can’t.
- tptacek 9y agoAppsec firms routinely test iOS applications with pinned certificates.
- throwaway2048 9y agoI doubt many app makers (or users for that matter) are interested in allowing that.
- slrz 9y agoI don't think that loading up a debug build with your dev certificates builtin is too much of a hassle for enabling MITM hooks.
- Sophira 9y agoI believe the parent comment is talking about auditing apps as a user, not as a developer, in which case debug builds will not be available.