New answers tagged mobile
0
By Messenger, I assume you mean Facebook Messenger.
In that case, assuming that you don't have a root certificate from your workplace installed on your phone, there is no way they can see the contents of your message as Facebook uses TLS/SSL.
However, if you have a root certificate that your workplace has made you install, then there is a certain ...
2
The encryption key is stored in the keychain. Most keychain items can be easily accessed with various phone breaker software.
Any device made by a large company cannot be guaranteed to be secure,unless you make your own hardware and software and communicate via encrypted protocols. Only then you can guarantee that your systems are safe. Even new encryption ...
1
Now if the mobile application is trusting any certificate issued by Digicert then you can effectively MiTM? Am I missing something?
Pinning against a CA does not mean that every certificate from this CA will be trusted for a site but that only certificates issued by this CA will be considered to be trustable in the first place.
CA pinning does not disable ...
1
Pinning a Root CA can prevent risks posed by other trusted Root CAs in the default certificate store. As mentioned in the link you shared (thank you), it's a deployment decision as to how high (or low) in the chain you would pin the certificate.
Check out this Security.SE post for more information for the underlying threat and some mitigations.
0
I am very interested in to know how you worked around that. NIST reference is good but does not cover specific scenarios like the one you described, My first thoughts were that following the principle of "grant access on a need To know" basis I would consider another role segmentation perhaps with a Logical Control within the devices itself, if they are ...
Top 50 recent answers are included
