1

I have a mobile application (ioS) which only certain users are allowed to use, and its coded in such a way that they could only login using secured VPN (with tokens) in order to access our internal network servers for data retrieval.

My auditor request that, according to good practices, all mobile apps development should try to incorporate certificate pinning.

I would like to challenge that argument: using VPN with multi-factor is, in my opinion, sufficient because both are methods of authentication and enables us to know who is really using the app. My mobile app is not an internet-based app and the database server which the app will retrieve data from is hosted internally.

Are VPNs and certificate pinning serving different purposes or they are approximately equivalent in this scenario?

5
  • 4
    Is it better to use a car or an electric razor ?
    – Stephane
    Feb 3 '15 at 15:52
  • What threat are you protecting against?
    – schroeder
    Feb 3 '15 at 19:10
  • 1
    I think the question now is, what threat does certificate pinning address that VPN doesn't?
    – schroeder
    Feb 4 '15 at 0:48
  • hi schroeder, yes something like that.
    – dorothy
    Feb 4 '15 at 1:14
  • Pinning is to try and make sure the clients/users connect to your servers and not an attacker's.
    – Brian
    May 7 '20 at 20:19
0

here are several scenarios to think about.

A) User loses mobile device. The pinned certificate only protects the phone so much as the built in password.

1) user loses device to malicious internal party. Without an iOS password, 3rd party breaks into network with that users NT/LDAP credentials
2) user loses device to external party. Strong password secures lost device

B) User loses mobile device. The VPN cannot be used by anyone else, because the token is still attached to the user.

1) VPN token is lost with device: token is revoked by administrator
2) Token is retained: token is bound to another device

C) Bound by fingerprint authentication in iOS.

1) The pinned certificate would continue working as expected
2) The VPN token serves as another layer of protection
-------------
C2 would serve well for Government and where absolute security required
C1 would use in Banking, Finance, Health
B2 is in Education, Research, Manufacturing

B1 and above are worst-case scenarios. Plan to not have them.

2
  • These are nice scenarios to think about but I'm not sure if they address the question. The OP isn't worried about the device password or securing the device at all.
    – schroeder
    Feb 3 '15 at 19:12
  • I don't think this addresses the question.
    – Pedro
    May 7 '20 at 15:59
-1

A VPN is a Virtual Private Network whereby traffic flows within an encrypted tunnel across networks. Often this is used to route Internet traffic from an arbitrary client, via a VPN server outside its network onto the Internet. This has the advantage of protecting client traffic in its local network, until it reaches the first router on the Internet. Traffic from that client coming from the VPN server to the destination is no different than whether the client would have connected directly. This acts at the operating system level, at the TCP/IP network stack. A VPN isn't really a tool designed to protect against a specific attack, it is instead a means to securely tunnel a connection across untrusted segments.

Certificate pinning is a technique whereby a developer ensures that a piece of code refuses to connect to a TLS server unless it presents the (or one of) pinned certificate. This acts at the software level, be it a mobile app or a browser or a desktop binary application. This is used to protect against attacks that somehow or emulate the server-side endpoint by leveraging TLS features.

These are different tools designed for different purposes.

An attack that certificate pinning would mitigate (but isn't implemented) would still be possible if the client connected via a VPN. Conversely, a client app with certificate pinning would have a level of reassurance of integrity and data confidentiality even when connecting via an untrusted network.

In your particular case, considering that your app is internal only, you can argue that your internal network is totally trusted (!) and that your VPN provides sufficient control for your requirements. This isn't entirely unreasonable. As long as you understand that these two features are designed for different purposes and mitigate different classes of attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.