3 ms·
You can always manipulate your client into making a connection interceptable by installing your own trusted root CA that can then do MitM. That possibility has
by thyristan 1y ago
You can always manipulate your client into making a connection interceptable by installing your own trusted root CA that can then do MitM. That possibility has always been there and didn't go away with TLS1.3.
It's just that many are too lazy to take control of their clients like that. Or they want to do surveillance on clients that aren't theirs to control.
- FuriouslyAdrift 1y agoCertificate pinning has made this very difficult/impossible. We are currently failing legal compliance audits at my work due to this and are having to move cloud things (legal,financial, customer NDA'd data, etc.) back to on-premise because if it. Our cloud HR and payroll systems are really having a tough time staying compliant as the data crosses compliance domains.
- thyristan 1y agoAgreed, didn't think of pinning. That does of course make it very difficult. However, compliance-wise, I'm of the opinion that anything cloud is a bad idea in general. It will just take some time for the bean-counters to realize (if ever).