Linked Questions
47 questions linked to/from What is certificate pinning?
1
vote
2
answers
6k
views
Understanding Certificate Pinning [duplicate]
I am attempting to implement certificate pinning across a suite of mobile apps.
I have been reading a lot about the different strategies (pinning to the CA/intermediate, pinning to a leaf cert, ...
- 113
2
votes
1
answer
3k
views
Whats the difference between certificate pinning and a truststore in Android/iOS? [duplicate]
I‘m facing the implementation of certificate pinning and often get asked why if there are trust stores within Android, iOS does not have such a concept. So I’m required to build the standard HPKP and ...
- 123
1
vote
0
answers
283
views
Mobile internet not working via zap proxy [duplicate]
I have to test the native android application on device, so
I Installed the zap certificated on my device and set the proxy in my device to my system ip where zap is installed and port to 8085.
In ...
- 121
117
votes
18
answers
20k
views
Does an established HTTPS connection mean a line is really secure?
From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
- 2,759
101
votes
5
answers
33k
views
How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]
I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute.
Question
How can my employer be a man-in-the-middle when ...
- 1,144
50
votes
7
answers
19k
views
How would you detect an Evil Twin attack, especially in a new environment?
Let's say you are traveling, and you pause in the airport lounge, or your hotel lobby, or a nearby coffee shop. You haul out your laptop and scan the available wireless networks. You know the name of ...
- 2,127
36
votes
7
answers
7k
views
Could governments and banks become CAs?
When you apply for a passport, driver's license, home mortgage, bank account, credit card, etc., the issuing organization must verify your identity. In the course of doing so, would it be feasible for ...
- 541
57
votes
4
answers
5k
views
What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)
There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
- 62k
28
votes
5
answers
7k
views
How does having a custom root certificate installed from school or work cause one to be monitored?
I was reading an article which said that if you install custom root cert from a third party then they can decipher all communication between you and others.
But that doesn't make sense. What I ...
- 725
22
votes
7
answers
64k
views
How do you capture ALL the traffic from an Android app?
I want to capture all the traffic from an Android app for its pen-testing. How do I do that?
Here's what I've already tried:
I installed the app on an emulator and started the emulator with a http-...
- 497
19
votes
2
answers
35k
views
Are VPNS vulnerable to active man in the middle attacks?
I know that with SSL/TLS, man in the middle attacks are not possible. For example if Alice and Bob are trying to communicate and Trudy is trying to perform a man in the middle attack, then when Alice ...
- 295
12
votes
4
answers
15k
views
Does a TLS interception proxy present the user's browser with the end server's certificate?
I know that TLS (commonly but mistakenly called SSL) interception works by establishing two encrypted tunnels between a client and server, with the interception device (proxy) terminating both tunnels ...
- 121
10
votes
7
answers
2k
views
Cheating or service disruption by altering client-side code
A reasonably white-hatted hacker has demonstrated the ability to insert text of his own choosing into the communication between a java applet and a web based server. Not a simple MITM attack, but ...
- 2,006
7
votes
3
answers
7k
views
What if someone steals a Certificate authority's private key? [duplicate]
What if someone could steal a Certificate authority's private key? I know this will (probably) never happen, but what would happen to the certificates that were already signed with this private key?
...
9
votes
3
answers
9k
views
Does checking the fingerprint of a self signed certificate improve security?
I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
- 341