Add SSL Pinning
s-yanev opened this issue · comments
Is your feature request related to a problem? Please describe.
Currently there is no SSL Pinning implementation, so it will be good to include one.
Describe the solution you'd like
Implement SSL Pinning.
Describe alternatives you've considered
N/A
Additional context
N/A
HPKP is "now-depecated" based on wikipedia and articles over the internet :)
https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
https://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning
it is old mechanism which has good intention but lead to misconfigurations so it is deprecated
HPKP is "now-depecated" based on wikipedia and articles over the internet :)
https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinninghttps://developer.mozilla.org/en-US/docs/Web/HTTP/Public_Key_Pinning
it is old mechanism which has good intention but lead to misconfigurations so it is deprecated
Thank you for the comment, drekinov.
What you're referring to is issues such as HPKP Suicide and Ransom PKP, which are typical for web solutions and as you pointed out, led to HPKP's deprecation for web and the lack of support for the header in browsers.
However, the above issues are not relevant or easily avoidable in native mobile solutions. This is because of some significant differences between the two technologies, such as the fact you have an independent bundle and full control over it and the pinning mechanism.
Thus, SSL Pinning is not at all deprecated for mobile apps - in contrary, it is widely used and a standard security enhancement for them. In fact it is a good to have best practice for both iOS and Android:
https://developer.android.com/training/articles/security-ssl
https://developer.apple.com/documentation/security/preventing_insecure_network_connections