HN2new | past | comments | ask | show | jobs | submitlogin

While certificate pinning is annoying, it's just an obstacle not a roadblock. I haven't met a security research that mentioned this to be a prohibitive feature.

There are couple ways out, from revers engineering the binaries, through jailbroken/rooted phones, running apps in simulators, etc.



You can't beat certificate pinning with offline analysis?


You can, if you want to read reverse engineered code. Takes more time, but completely doable. I do that on all Android apps.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: