New answers tagged

0

For the purposes of securing an API for an Android app a self-signed certificate is fine. If you pin multiple certificates (or even your own CA), and use only one, you can even revoke them without an update to your app. This is one of very few cases where self-signed, DV or EV makes no difference. Do make sure that you use at least DV on all websites ...


0

HTTPS does not prevent DNS spoofing, since these two protocols work at different layers and in fact HTTPS, because of the X.509 certificates that underline the Web PKI, need the DNS (both at certificate issuance time and also at client verification time), while the DNS does not need HTTPS to work (of course when you do not use it explicitly like with the ...


Top 50 recent answers are included