So I have been reading about SSL pinning in context of a requirement where we have to interact with a web service operated by a partner of ours. We have an Android App and we would be making network calls to their service in a WebView(embedded web browser) and while SSL pinning has been labeled as the solution to verify identity really, I am still not clear on the fundamentals.
Say, I am interacting with Google. Firefox shows me their certificate details. If I were to be able to try out a MITM for a request to Google, can't I just copy Google's certificate(which seems to be a public information) and provide that as my certificate?
I don't see pinning help any identity cause. What have I left out of the story?