Hacker News Reader

Certificate pinning is absolutely targeted at stopping the use of rogue root CA's installed in devices. OWASP does a pretty good job of covering the topic.

https://www.owasp.org/index.php/Certificate_and_Public_Key_P...

View on HN

You just linked to 20 screenfuls of text that explain pinning in general, without a single mention of "rogue".

The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislation.

Of course a system misbehaves if you use an (intentionally) broken application. That's a Google Chrome issue and not an issue with pinning.

You might have a point if Chrome hadn't been the first browser to implement pinning, therefore defining the concept in web context to a large extent.

You may argue that this is is broken behaviour, but that's what pinning currently is in browsers. Seems it's this way in Firefox too ("pinning not enforced if the trust anchor is a user inserted CA, default" - https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...)

Reply on news.ycombinator.com