4 ms·
Not really, that is also vulnerable to man in the middle attacks. You need cert pinning or a fool proof trust system to verify the server key.
by fleitz 13y ago
Not really, that is also vulnerable to man in the middle attacks.
You need cert pinning or a fool proof trust system to verify the server key.
- comex 13y agoNot if the server key is just hardcoded into the app, which can be appropriate in some cases; of course, that raises the question of how to secure the app download, but that's usually done over a separate protocol anyway.
- geal 13y agoIn fact, the app ships with a bunch of RSA 2048 keys that are used for that part. But there is no revocation support.
- fleitz 13y agoYeah that's generally the downside of cert pinning / hardcoding. The upside is people can't install extra certs.