In the OWASP top ten list for mobile, it is mentioned that self-signed certificates should never be allowed.
I want to check with others why is this so ? If I have a server back end for my mobile app, and I sign a key-pair myself (assuming myself as a CA). If I use pinning, I will use my own CA's public key to check the certificate, and then use the server's public key (this part seems safe to me - assuming attacker doesn't know the private keys).
But if I don't use pinning, then is the risk there because now the default CA's in Android can't be used to verify the certificate, and I will have to use trust all certificates to make it work ?
In Summary: I am asking about the situation when self-signed certificates are used without pinning for an Android app.