PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Certificate Pinning: Enhancing Client-Side Security

hackerone.com | blog | #appsec | #mobile-security | #tls | #pki | #mitm | #certificate-pinning | #client-security | #certificate-authority
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Explains certificate pinning in clients: basic public-key pinning versus more flexible certificate chain pinning, and how each defends against MITM attacks and compromised certificate authorities.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Let’s Encrypt the Internet
Trail of Bits announces support for Let's Encrypt, the open, automated, and free certificate authority, arguing removing cost and renewal friction is key to making HTTPS the default across the web.
blog · blog.trailofbits.com
We build X.509 chains so you don’t have to
Trail of Bits and the Python Cryptographic Authority built a pure-Rust X.509 path validation implementation for the cryptography library plus the x509-limbo conformance test suite.
blog · bishopfox.com
Breaking HTTPS in the IoT: Practical Attacks For Reverse Engineers
Nathan Elendt shares three man-in-the-middle techniques for breaking HTTPS on production-grade IoT devices, starting with the default TLS hijacking attack that usually just works.
blog · netspi.com
Certificate Pinning in a Mobile Application
Mobile apps are common MITM targets; certificate pinning — hardcoding trusted certificates or public keys in the app — helps by rejecting every certificate outside the pinned set.
vulnerability · blog.trailofbits.com
The issue with ATS in Apple’s macOS and iOS
Trail of Bits discloses CVE-2023-38596: Apple's ATS fails to enforce encryption for IP-address and .local connections, exposing iOS and macOS apps to MitM attacks and data exposure.
blog · hackerone.com
Understanding HTTP and the Critical Shift to HTTPS
A foundational explainer on how HTTP works over IP and TCP, why plaintext transmission endangers privacy and integrity, and why HTTPS encryption became essential for the web.
Back