6 ms·
Certificate pinning is just another attack vector, and MS/Apple/Google may all be keeping the NSA apprised of changes to browser/device certificate policies (in
by ihsw 13y ago
Certificate pinning is just another attack vector, and MS/Apple/Google may all be keeping the NSA apprised of changes to browser/device certificate policies (inadvertently or otherwise).
- MichaelSalib 13y agoWhat do you mean?
- tjohns 13y agoCare to elaborate? I don't see how publishing a list of fingerprints of trusted certs would facilitate an attack. Especially given that the underlying certificates are public knowledge, sent as part of every HTTPS session.