search

hCaptcha / hcaptcha-android-sdk

Android SDK for hCaptcha
https://www.hcaptcha.com
MIT License
73 stars 36 forks source link

Android SSL-certificate pinning #32

Open CAMOBAP opened 2 years ago

CAMOBAP commented 2 years ago

Looks like no third-party libraries need, ~this can be achieved by a single config https://developer.android.com/training/articles/security-config#CertificatePinning~

Upd. We need to be able to update certs: https://github.com/wultra/ssl-pinning-android allow dynamic SSL pinning

e271828- commented 2 years ago

This would have the same issue as any naive pin: you can get stuck on an old cert. Their suggestion to expire pins after time X is laughable.

Check out the same source used for the iOS pinning for Android details.

androidacy-user commented 3 months ago

This would have the same issue as any naive pin: you can get stuck on an old cert. Their suggestion to expire pins after time X is laughable.

Check out the same source used for the iOS pinning for Android details.

It's much safer and reliable to pin the root cert instead. Almost the same level of peace of mind, without having to stay ahead of the ever shorter expiry dates. Android permits you to specify certain root(s) is/are trusted for a domain.