4 ms·
Mobile developers can implement certificate pinning to prevent man in the middle snooping. Twitter's app does this.
by powvans 5y ago
Mobile developers can implement certificate pinning to prevent man in the middle snooping. Twitter's app does this.
- arsome 5y agoThat achieves nothing against someone who uses something like apktool/baksmali to do static RE, let alone inject something like Frida to perform dynamic RE. There are even Xposed modules designed to just bypass certificate pinning. Certificate pinning is a good security measure, but not a counter-RE one.
- saagarjha 5y agoCertificate pinning is neither a good security measure nor a good obfuscation one.
- feanaro 5y agoI hope you did not just assume that general purpose computing and device ownership can be subverted by mere certificate pinning. If it's executing on my device, you can be sure I can poke it and see what it's doing.
- dotancohen 5y agoYour device? Posting on HN, I'm sure that you are aware that the mobile touchscreen computers in most people pockets are "owned" not by the consumer but by the manufacturer long after the device was _purchased_ by the consumer. Do you have, or can you easily get, root access? Swap the bootloader? Install an alternate ROM? And even if _you_ can, the far majority of consumers cannot.