I have doubt. For android application security which SSL pinning method is good?
- Deploying HTTP Public key pinning
- Deploying certificate validation using *.bks format along with hostname verifier.
Second one is recommended more for Critical Infrastructure such as Military according to some experts.
In HTTPPubliKeyPinning there is an advantage that I can give an array of numerous public key. So that if one of my certificate gets expires, app will automatically switch public key of other certificate on other domain.
Where in BKS, developer need to append new certificate in APK and have to give client using force update else application will not work.
However, exploit ability metrics has the same time frame. I can exploit flaw 1 as well as flaw 2 using Xposed framework using JustTrustMe application within it. It will require same amount of time and effort. Also in both scenario if hacker successfully repackages application using 1. our public key or using 2. certificate after reverse engineer, he/she will be able to bypass these restrictions. Any other benefit of using second method?. Is there any good method available than this?
So with the accordance of business continuity and security which one is best?