3 ms·
Certificate pinning usually (ex: Chrome) is implemented with an exception to allow a company administrator to install a new root CA cert on the device and MITM
by cbr 12y ago
Certificate pinning usually (ex: Chrome) is implemented with an exception to allow a company administrator to install a new root CA cert on the device and MITM connections. Does iMessage not allow this?
- acchow 12y agoThis Chrome behavior surprised me so I checked the source. Indeed, you are correct. Pin checking is short-circuited if the cert is signed by a root. ` if (!is_issued_by_known_root || !HasPublicKeyPins(host, sni_available)) { return true; } ` https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state.cc&q=kPreloadedSTS&sq=package:chromium&type=cs&l=137 https://code.google.com/p/chromium/codesearch#chromium/src/n...
- lawnchair_larry 12y agoWell I'll be damned. Those sneaky bastards. Thanks for pointing this out.