Hacker News new | ask | show | jobs
by anontestuser234 3717 days ago
will certificate pinning flag anything if the user installs a new root cert on their device?
2 comments

That depends. I'm not sure what iOS or Android do here, but Chrome (as an example, since its behavior is well-documented) does not perform pin validation when the presented certificate chains up to a private trust anchor (i.e. a user-installed root cert) [1]. This was a deliberate choice on the part of the Chrome team, to allow this type of MITM (presumably because it's not uncommon in enterprise environments).

[1] http://www.chromium.org/Home/chromium-security/security-faq#...

Typically the app that uses certificate pinning will just cease to use data during a typical mitm attack. Kind of like going into airplane mode.