Implement certificate pinning for Brave/BraveSoftware domains

brave / brave-ios

Brave iOS Browser

https://brave.com

Mozilla Public License 2.0

1.7k stars 441 forks source link

Implement certificate pinning for Brave/BraveSoftware domains #2440

Open jumde opened 4 years ago

jumde commented 4 years ago

Description:

Certificate Pinning reduces the impact of MITM attacks. We should PIN certificates for .brave.com and .bravesoftware.com domains to ensure the responses from these domains can be trusted.

Certificate Pinning is already implemented: https://github.com/brave/brave-ios/blob/f8b4d52df2cea77ac624a8621def3825f89511dd/BraveShared/CertificatePinning.swift - Just needs to be enabled.

iccub commented 4 years ago

Does this block the super referrer work or can be implemented later/separately?

diracdeltas commented 4 years ago

@iccub not blocking