[dzhiurgis]

So what DOES pinning protect against? Certs generated by state actors with access to CA’s?

[frankchn]

That, and (more commonly) CAs mis-issuing certificates to malicious actors due to bugs or weak internal controls.

[jevinskie]

You can enforce certificate pinning in your own native app. You can even go as far as not trusting the hookable (on a JBen device) system libraries and link in your own OpenSSL or something similar.