3 ms·
For mobile apps, though, you can bootstrap HPKP with a key built into the app. I worked on an app doing this, and it would certainly fail to connect in this sce
by ralphm 7y ago
For mobile apps, though, you can bootstrap HPKP with a key built into the app. I worked on an app doing this, and it would certainly fail to connect in this scenario.
- vbezhenar 7y agoA lot of internal enterprise networks use MITM, so your app won't work there as well. It might be a good thing or not, depending on your use-case.
- ralphm 7y agoYeah, I considered this a feature. As mentioned elsewhere in these comments, we should have a way to limit the scope of corporate certs.
- jcrites 7y agoOne solution is to use Name Constraints. The organizational certificate authority could be issued with Name Constraints limiting its power to a certain domain name only, e.g. *.example.com, using Permitted Subtree. If I was setting up an organizational CA for internal websites (not MITM), I would consider using Name Constraints to limit the certificate's scope and potential for abuse or compromise.
- gsich 7y agoIf the app is not for that particular corporation, then no harm done.