4 ms·
The issue wasn't with the cert, but with the signature verification, <https://www.imperialviolet.org/2014/02/22/applebug.html> https://www.imperialviolet.org/20
by lwf 13y ago
The issue wasn't with the cert, but with the signature verification, <https://www.imperialviolet.org/2014/02/22/applebug.html> https://www.imperialviolet.org/2014/02/22/applebug.html>:
> Because the certificate chain is correct and it's the link from the handshake to that chain which is broken, I don't believe any sort of certificate pinning would have stopped this.
- zeckalpha 13y agoI still think a well-put-together banking application wouldn't be vulnerable to this.
- jleader 13y agoIf a bank app wrote their own security code, and didn't use the standard platform library, then when a bug was found, they'd get piled on here for rolling their own and not going with the much more widely tested platform implementation. Should a well-put-together banking application re-implement the entire OS? After all, there are lots of places where security bugs can hide throughout the OS.