3 ms·

Also, don't most Google apps use certificate-pinning these days? I don't think this is super plausible.

• Groxx 13y ago
  Not that I'm aware of. I've man-in-the-middled a few of them in the past couple months. On my phone, Twitter and Foursquare are the only ones that I've seen that actually do certificate pinning.
  • trotsky 13y ago
    As I understand google policy, they allow a user supplied CA to over-rule certificate pinning, to allow for the common use case of an enterprise supplied certificate rewriting at the firewall. So unless you're using one of the magic wildcard sub-ca certs issued by a default CA I suspect you're seeing the google apps allowing an exception to pinning.
    • Groxx 13y ago
      If so, that's pretty cool. Happen to know if foursquare / twitter have anything in place that lets them handle the enterprise case w/o letting me mitm them?
      • trotsky 13y ago
        nope. i've only heard of google doing any real messaging re: pinning.