hey, when using selfsigned ssl cert
and hardcoding...
# randomu
ursus
09/19/2018, 6:27 AMhey, when using selfsigned ssl cert
and hardcoding it in the apk, so its the only one in the trust manager
does it make sense to implement public key pinning via okhttp certificate pinner?
isnt it the same thing?
m
maxmello
09/19/2018, 7:45 AMAfaik they are not the same, they are listed as different security methods here: https://developer.android.com/training/articles/security-ssl
Here is a very exhaustive article about pinning: https://medium.com/@appmattus/android-security-ssl-pinning-1db8acb6621e
u
ursus
09/19/2018, 2:40 PMright, but arent ultimately pins calculated from certificates? so if i trust only 1 cert, isnt that effectively the same?
3 Views