3 ms·
No, the purpose of pinning is to stop a compromised CA from issuing their own www.google.com cert. If someone installs a CA, Chrome will trust it. There's not
by danielweber 12y ago
No, the purpose of pinning is to stop a compromised CA from issuing their own www.google.com cert.
If someone installs a CA, Chrome will trust it. There's not much way around this: if someone has the capability to install a CA on your computer, they'd have the capability to modify chrome.exe to force acceptance of it.
Also, sometimes MITM'ing is desired. I'm doing it right now with Firefox and BurpSuite.
- cm2187 12y agoI think the problem is rather giving a false sentiment of security to the unsuspecting user.
- danielweber 12y agoChrome could display a notice reminding users that it's an executable that can be compromised by other programs. But those other programs could also delete that notice.
- cm2187 12y agoI was thinking more something like an amber icon instead of green, which shows this connection is somewhat secure but there are problems detected.