9 ms·
If the user wants to ignore cert error they're going to ignore cert errors
by patmorgan23 3y ago
If the user wants to ignore cert error they're going to ignore cert errors
- michaelt 3y agoPinning your CA's certificate protects against two things: 1. All-powerful NSA types who've managed to steal a CA's private key or get a certificate mis-issued. It's a nigh-irreplaceable attack opportunity, but the moment they use it it'll be revoked within hours, so naturally it's reserved for the absolute highest value target. For example, [1] 2. Users trying to reverse-engineer your app. You can imagine which of these is the most common - perhaps you don't want the user to be able to bypass the pin, even intentionally. [1] https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...