Collaborate Disseminate
I’m currently designing the security controls of an Android Application and willing to have Certificate Pinning. I’m familiar with the concept and have seen various implementations in the past, yet this Android Application is… Continue reading Certificate Pinning with CDN
I am trying to intercept the ssl traffic from a windows thick client with Burpsuite’s NoPE Proxy extension.
But whatever traffic is intercepted, is in encrypted form. I tried using the burpsuite certificate but it didn’t wor… Continue reading How to intercept ssl tcp traffic for desktop applications?
I am trying to intercept the ssl traffic from a windows thick client with Burpsuite’s NoPE Proxy extension.
But whatever traffic is intercepted, is in encrypted form. I tried using the burpsuite certificate but it didn’t wor… Continue reading How to intercept ssl tcp traffic for desktop applications?
Public-key pinning is a proposal that allows sites to pin their keys in the browser to protect against Man In The Middle attacks that try to forge a site’s key. See
Internet Engineering Task Force (IETF)’s RFC 7469
My ques… Continue reading How are pinned keys stored in the browser? How about performance with large lists?
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like to use LE certs in our mobile apps as … Continue reading iOS & Android Certificate Pinning with Lets Encrypt
We are implementing public key pinning in iOS app using AFNetworking framework using below code
– (BOOL)evaluateServerTrust:(SecTrustRef)serverTrust
forDomain:(NSString *)domain
{
NSMutableArray *po… Continue reading Public key pinning in iOS with AFNetworking
I’m trying to reverse engineer an app that has Native layer certificate pinning, I can’t go that deep in to patching so I’ve been looking in to other available options, one i came accross was appmon, but the apk i built using… Continue reading Bypassing Certificate/SSL Pinning using AppMon
My use-case is the following:
I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I’m not actually authenticating the machine but only the domain.
If my ac… Continue reading Can I somehow require a specific certificate for a domain?
I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it should be impossible to man i… Continue reading Certificate Pinning vs E2E Encryption
SMTP Strict Transport Security is coming to major webmail providers this year, a Google engineer said at RSA Conference Continue reading SMTP Strict Transport Security Coming Soon to Gmail, Other Webmail Providers