3 ms·

I suppose they could be using cert pinning[1]. [1]: http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html

• markild 14y ago
  Absolutely. I wish they would address the topic, though. I interpret this article as if they mean that HTTPS solves all censoring and content sensing issues, regardless.
• StavrosK 14y ago
  You mean Apple? In that case, I don't understand how that would help. The user never sees Apple's certificate, they only see the one presented by the MITM, no?
  • markild 14y ago
    In this case, if understand the concept correctly, it would be iTunes that pins the certificate authority for the iTunes server. One would still be vulnerable of a corrupt CA. The only solution to this would be to issue all certificates from an internal CA and verify this in your application.
    • StavrosK 14y ago
      Or you could just harcode the certificate fingerprint and refuse to accept anything else. It's trivial when you own the client. I'm not sure if this would break when you needed to renew the certificate, but I guess you only update the signature, not the actual public key.
      • sp332 14y ago
        But if China is already MITM, they can modify or replace the binary while you are downloading it.
        • StavrosK 14y ago
          Yep. In that case, you don't own the client.
    • phillmv 14y ago
      When you ship your own browser and OS you can prob get away with that.