Hacker News new | past | comments | ask | show | jobs | submit | anontestuser234's comments login

will certificate pinning flag anything if the user installs a new root cert on their device?


That depends. I'm not sure what iOS or Android do here, but Chrome (as an example, since its behavior is well-documented) does not perform pin validation when the presented certificate chains up to a private trust anchor (i.e. a user-installed root cert) [1]. This was a deliberate choice on the part of the Chrome team, to allow this type of MITM (presumably because it's not uncommon in enterprise environments).

[1] http://www.chromium.org/Home/chromium-security/security-faq#...


Typically the app that uses certificate pinning will just cease to use data during a typical mitm attack. Kind of like going into airplane mode.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: