5 ms·

Installing a custom SSL root certificate feels like such a good idea. Not. But I guess in order to get something for free, people are willing to go great lengt

by pilif 14y ago

Installing a custom SSL root certificate feels like such a good idea. Not. But I guess in order to get something for free, people are willing to go great lengths in compromizing their security. Remember: By installing that guys SSL root certificate, you basically allow them to MITM not just the App store in-app purchasing (and by extension likely sniff your app store password) but also any other SSL protected site like, say, your webmail provider.

dfc 14y ago
As long as your browser does not pin certificates.
- pilif 14y ago
  Which safari on iOS doesn't do. Nor does the AppStore app. Obviously. Otherwise, this site wouldn't work
  - dfc 14y ago
    I was referring to the browser sniffing webmail. Is the appstore a browser? I thought it was an application.
    - ary 14y ago
      Applications outside of browsers use SSL.