Hacker News Reader

Comment by jtokoph | Hacker News Reader

It looks like the demo they do with the reporter leaves out a the part where the "landing page" for the wifi prompts the user to install a new root certificate on the device so that his proxy can listen in on all of the traffic.

This is the smartphone version of fake pirated media that asks you to download a special desktop "media player" that ends up just being malware. The average user will just accept whatever prompts they are given for free access to wifi. Certificate pinning will be much more important once this becomes mainstream.

View on HN

> Certificate pinning will be much more important once this becomes mainstream.

On the flip side, certificate pinning prevents an end user from seeing what data an app is transmitting. Standard Man-in-the-Middle solutions like Burp no longer work when an app is cert pinning.

The only way (to my knowledge) to overcome this isto attach a debugger to the app and manually strip the ssl or view the packets prior to being sent.

> The only way (to my knowledge) to overcome this isto attach a debugger to the app and manually strip the ssl or view the packets prior to being sent.

And that is the very intention.

Both as a user and a software engineer I find this perfectly natural. The app developer could have implemented this himself or just used public-key encryption on top of his HTTPS enabled but not certificate-pinned application.

will certificate pinning flag anything if the user installs a new root cert on their device?

Typically the app that uses certificate pinning will just cease to use data during a typical mitm attack. Kind of like going into airplane mode.

That depends. I'm not sure what iOS or Android do here, but Chrome (as an example, since its behavior is well-documented) does not perform pin validation when the presented certificate chains up to a private trust anchor (i.e. a user-installed root cert) [1]. This was a deliberate choice on the part of the Chrome team, to allow this type of MITM (presumably because it's not uncommon in enterprise environments).

[1] http://www.chromium.org/Home/chromium-security/security-faq#...

Reply on news.ycombinator.com