Move over certificate pinning. Certificate transparency is here!
summary
Certificate Transparency is already replacing pinning in Chrome and actually prevents silent misissuance by publicly logging certificates in append only Merkle tree logs, with real-world catches at Facebook and Google. Babylon Health ships an open-source Android library that embeds and verifies SCTs, supports OKHttp, Volley and HttpURLConnection, is backwards compatible to API 19 with no native code, includes unit and integration tests, published threat models and external pentests that so far fail to bypass it, but Android still ignores certificate revocation.
AI-written summary · about
related talks
13mLightning Talk: Move Over Certificate Pinning. Certificate Transparency is Here!
51mCertificate Transparency Logs: Roadmaps to Riches or Ruin?
26mFrom HTTPS Basics to Network Security Configuration
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
33mCats? In My Certificate Transparency Logs?
25mHow SSL Pinning Reinforces iOS App Security
20mTrust Agility in an Era of Transient Ties: Rethinking TLS...
28mTrustBase: An Architecture to Repair and Strengthen...