undefined | Better HN

0 pointssnek7y ago0 comments

Why can't they just install their own self signed root ca on all their computers and continue MITM it?

0 comments

Certificate pinning is used by some very common applications and can break a MITM that relies on a self-signed certificate.

JoshTriplett7y ago

Then those applications are correctly getting the behavior they desire: either they get a secure connection or they don't connect at all.

Legogris7y ago

Do you have any example of such applications that would be used by a bank?

yfiapo7y ago

I don't work for a bank so I can't speak definitively to their applications. A few sample applications I see listed as certificate pinned in Netskope (a CASB) though include:

  Adobe Creative Cloud
  Amazon Work Spaces
  Docusign
  GitHub
  Google Drive
  GoToMeeting
  iCloud
  Microsoft Office 365 Outlook.com
  Microsoft Skype for Business
  Salesforce.com

Note this typically refers to native applications and plugins which also connect over TLS and not web applications.

2 more replies

goda907y ago

Are those common applications necessary for their business operations though? They could just blacklist them entirely.

vetrom7y ago

besides, many of those applications depin when you install custom CAs, don't they?

j / k navigate · click thread line to collapse

0 comments

yfiapo7y ago

Certificate pinning is used by some very common applications and can break a MITM that relies on a self-signed certificate.

JoshTriplett7y ago

Then those applications are correctly getting the behavior they desire: either they get a secure connection or they don't connect at all.

Legogris7y ago

Do you have any example of such applications that would be used by a bank?

yfiapo7y ago

I don't work for a bank so I can't speak definitively to their applications. A few sample applications I see listed as certificate pinned in Netskope (a CASB) though include:

  Adobe Creative Cloud
  Amazon Work Spaces
  Docusign
  GitHub
  Google Drive
  GoToMeeting
  iCloud
  Microsoft Office 365 Outlook.com
  Microsoft Skype for Business
  Salesforce.com

Note this typically refers to native applications and plugins which also connect over TLS and not web applications.

2 more replies

goda907y ago

Are those common applications necessary for their business operations though? They could just blacklist them entirely.

vetrom7y ago

besides, many of those applications depin when you install custom CAs, don't they?

j / k navigate · click thread line to collapse