[schoen]

Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.)

Edit: I think that's the case. AGL's original announcement of pinning said:

"There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

https://www.imperialviolet.org/2011/05/04/pinning.html

If Chrome thinks that this was a "user installed root CA", it would have been allowed to override the pin. (Disclaimer: I haven't checked that this is right, I'm just using my recollection of how this could work according to AGL's account.)

[lazyjones]

> Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections

"openly"? Why doesn't the user see that a fake certificate is being used then? There is no excuse for not showing a big fat warning.

This only shows which side Google is really on when it's evil corporations vs. you, the user.

[beagle3]

"openly" usually means "it was burried in a paragraph on page 25 of the 3rd addendum of their employment agreement".

[edohyiez]

Ah, That explains it. Thanks! And to semenko too.

[schoen]

It points to an interesting problem that, while browser vendors officially think that users ought to be notified when someone is using an intercepting proxy -- that it shouldn't be invisible to them -- when users aren't installing their own OS or configuring their own browser, it could be completely invisible in practice.

So the IT department-installed or OEM-installed cert is treated as "user-installed" by the pinning logic, and the user never actually gets warned.

[justcommenting]

As someone who respects your work, I would suggest that perhaps the more interesting problem is EFF's structural inability to do anything but apologize for Google policies and practices that clearly and obviously harm user freedom and privacy.