Even after enabling HTTPS the user is not completely safe regarding MitM attacks, because there is the chance of a compromised root certificate store. So of course you can use certificate pinning for mobile apps. But are there additional options to securely transfer the login data/critical data?

  • Compromised root certificate store is an attack on the endpoint, not an MITM attack.
    – Lie Ryan
    Dec 30, 2016 at 2:08
  • True, but a compromised certificate store can be used for a MitM attack.
    – Malte G
    Dec 30, 2016 at 2:10
  • If you want to protect against mitm/snif, you may also like to read about BREACH.
    – Xavier59
    Dec 30, 2016 at 4:03
  • @Malte: By default, public key pinning is not enforced against user-installed certificate (wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning, chromium.org/Home/chromium-security/…). If your adversary can install their root certificates on your trust store, they can MITM pinned site anyway.
    – Lie Ryan
    Dec 30, 2016 at 5:23

4 Answers 4


... because there is the chance of a compromised root certificate store.

You effectively assume that the attacker is able to compromise the system where the client is running on. In this case it is impossible to protect the client. While certificate pinning can be used to protect against a modified trust store the attacker can still modify the client itself and thus get to the unencrypted data. Examples for this are browser extensions which have access to the plain data but it can also be done with replacing the TLS library linked to the client application or modifying the client application itself.

Like the name suggests: a man in the middle attack is only about a man in the middle and not about a man in the client. Properly implemented TLS protects against man in the middle but cannot protect against a compromised client or server like in your case. And there is no way to fully protect the data if client or server is already compromised.


You could use a VPN, so the VPN server makes the request to the server over HTTPS, after you've connected to the VPN. Of course, this means you have to make sure the VPN server is secure.


The approach is to get the certificate as on the running context of the client and then compare it with your original certificate. This is the same approach of certificate pinning if you are developing an app. If you want it for web browser, then you can develop a flash object to do the same or use Forge project: https://github.com/digitalbazaar/forge/


What is the type of application you are using (web app/ web service)?

If the client is non browser, An additional layer of encryption can be implemented on top of TLS ( like message security in WCF).

You can also implement the certificate pinning for custom apps.

  • The OP already mentions pinning.
    – schroeder
    Dec 30, 2016 at 7:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .