2 ms·

Application doesn't even need to use root CAs from system, it can ship its own; the problem starts when you try to make system browser part of your app

• tsimionescu 4y ago
  That quickly breaks in the presence of MITM traffic analyzers, such as most companies use for their internal networks.
  • ilyt 4y ago
    "Breaks" as in "app is secure when faced by hostile actors"
    • tsimionescu 4y ago
      I'm talking about secure networks, where all traffic has to be monitored to ensure nothing is accidentally leaked, that malware doesn't easily spread, or that proxies aren't used to circumvent filtering. MITM devices configured by the user are very much friendly actors, and an important component of defense in depth. To be clear, the way these normally work is that they have their own root CA that devices participating on the network add to their trust stores voluntarily.