1

I am using this Cordova plugin to implement SSL pinning in an Android application.

I don't know how to simulate the environment for testing if it's working fine.

The infosec team in my firm is telling me that if the connection is proxied (no other attacking thing), then the application will be getting another certificate from the proxy server and the app should alert about this.

But the above plugin tells me that the connection is secure even on proxied connections.

1

The infosec team probably meant using an intercepting proxy such as ZAP or Burp. A normal proxy passes the SSL connection through, using the original certificate. With an intercepting proxy your browser sets up a connection to the proxy, which has a different certificate.

1

Cordova does not support SSL Pinning - https://cordova.apache.org/docs/en/latest/guide/appdev/security/#certificate-pinning. The plugin you are using may be providing you an approximate SSL pinning feature. However, from a security standpoint, I think an approximate or fake SSL pinning is as good as having no SSL Pinning. If you really need to have SSL pinning in your App consider developing your App natively.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.