2 ms·

They're mainly trying to issue certs for public facing websites. If your service is in a position where someone can install an alternative root CA on your webse

• gkbrk 3y ago
  The threat model isn't "someone will install stuff on our servers". The threat model is "some user will look at the network traffic and see all the personal data we're hoovering from their phone". Sometimes also "some user will look at the network traffic and notice that we have 0 server-side security".
  • kobalsky 3y ago
    Also, some companies[1] have been caught being naughty and installing CA certs which allowed third parties to MiTM local connections. This was a major issue and, at least in my case, what drived many to pin certs at the time. [1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...
  • Sohcahtoa82 3y ago
    > The threat model is "some user will look at the network traffic and see all the personal data we're hoovering from their phone". If you're talking about someone wanting to examine an app they have installed, there's nothing a developer can do about it. There are frameworks like Frida that allow you to disable pinning or disable certificate verification entirely in an app. I did this myself once while reverse-engineer the API that an app was using. Configured my phone's system proxy to point to Burp Suite, then used Frida to disable certificate verification in the app so it'd let Burp do its MitM magic, and I could see all the app's network traffic.