5 ms·
>Caution: Certificate Pinning is not recommended for Android applications due to the high risk of future server configuration changes, such as changing to anoth
by forgotmypw17 4y ago
>Caution: Certificate Pinning is not recommended for Android applications due to the high risk of future server configuration changes, such as changing to another Certificate Authority, rendering the application unable to connect to the server without receiving a client software update.
This actually applies to websites and browsers as well.
- metadat 4y agoWhy isn't there a site-controlled fallback setting for this? Does this not make sense? Abu given website's beet interest is to continue to be reachable.
- tremon 4y agoEvery escape hatch in the certificate validation is also an additional avenue for attack. For example, using a DNS record to override certificate pins makes DNS cache poisoning much more valuable to the attacker.
- forgotmypw17 4y agoEvery layer of security is also an additional accessibility hurdle.
- metadat 4y agoGot it, thanks @tremon.