It is known fact that in android there are couple of tools which can bypass ssl pinning such as Justtrustme, Android-SSL-TrustKiller. In iOS there are ios-SSL-Killswitch.
I had 3 options to implement ssl pinning in my application.
- Using a simple HttpsURLConnection with a PinningTrustManager
- Using a simple HttpClient with a PinningTrustManager
- Working with PinningTrustManager and PinningSSLSocketFactory more directly
I tried all 3 options however it was possible to bypass these mechanism. I found that last option was bit secure compare to other two as few tools did not able to bypass but one did.
Here is my pseudo code example for pinning.
// Get an instance of the Bouncy Castle KeyStore format
KeyStore trusted = KeyStore.getInstance("BKS");
// Get the raw resource, which contains the keystore with
// your trusted certificates (root and any intermediate certs)
InputStream in = getResources().openRawResource(R.raw.key);
try {
// Initialize the keystore with the provided trusted certificates
// Provide the password of the keystore
trusted.load(in, KEYSTORE_PASSWORD);
} finally {
in.close();
}
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(trusted);
Is there any secure solution of at least the best available solution for implementation?