I had a question when reading this article:
(Basically, some Android apps, like Chase's banking app for example, may be ignoring certificate validation errors, possibly because the app is trying to accommodate outdated CA lists on older devices and Android versions.)
In the context of this sort of banking app, why wouldn't the developer use a private CA instead of signing the server (and, for that matter, client) certificates through one of the public CAs? The developer controls both ends of the transaction, after all. Am I missing something, beyond laziness?