I have a mobile application (ioS) which only certain users are allowed to use, and its coded in such a way that they could only login using secured VPN (with tokens) in order to access our internal network servers for data retrieval.

My auditor request that, according to good practices, all mobile apps development should try to incorporate certificate pinning.

I would like to challenge that argument: using VPN with multi factor is, in my opinion, sufficient because both are methods of authentication and enables us to know who is really using the app. My mobile app is not an internet based app and the database server which the app will retrieve data from is hosted internally.

So my question is: Are VPN and Cert pinning serving different purposes or they are approximately equivalent?

  • 4
    Is it better to use a car or an electric razor ? – Stephane Feb 3 '15 at 15:52
  • What threat are you protecting against? – schroeder Feb 3 '15 at 19:10
  • hi schroeder and Stephane, thanks for comments. I edited my question. – dorothy Feb 4 '15 at 0:44
  • I think the question now is, what threat does certificate pinning address that VPN doesn't? – schroeder Feb 4 '15 at 0:48
  • hi schroeder, yes something like that. – dorothy Feb 4 '15 at 1:14

here are several scenarios to think about.

A) User loses mobile device. The pinned certificate only protects the phone so much as the built in password.

1) user loses device to malicious internal party. Without an iOS password, 3rd party breaks into network with that users NT/LDAP credentials
2) user loses device to external party. Strong password secures lost device

B) User loses mobile device. The VPN cannot be used by anyone else, because the token is still attached to the user.

1) VPN token is lost with device: token is revoked by administrator
2) Token is retained: token is bound to another device

C) Bound by fingerprint authentication in iOS.

1) The pinned certificate would continue working as expected
2) The VPN token serves as another layer of protection
C2 would serve well for Government and where absolute security required
C1 would use in Banking, Finance, Health
B2 is in Education, Research, Manufacturing

B1 and above are worst-case scenarios. Plan to not have them.

  • These are nice scenarios to think about but I'm not sure if they address the question. The OP isn't worried about the device password or securing the device at all. – schroeder Feb 3 '15 at 19:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.