What is SSL pinning?

iOS Engineer, Marty Burolla, gives us the 4-1-1 on SSL Pinning, but not before he gives us a helpful rundown on the importance of secure web connections.

New to development or a pro who needs help? Just tweet your question to #AskADev. We’ll pick the best ones and have a developer answer them.

[usmanf]

A picture is worth a thousand words. What's the use of this being uploaded as Video, could have done it just with audio as there is no drawing, pictures or animations. The brief given is good but for somebody without a background in security needs to listen at least a few times to clear up the concept.

[renatostauffer]

I have a question: So you said that we compare the public key from the server with the key we pinned on the client. What if an attacker just grabs the public key from the server and uses this on his own fake server to pretend it is the correct server?

[andriibogachenko]

I`ll mark a like. Because explanation is rather good, with perfect English. But it`s much much better to describe all those things on schemes, and graphs. I`ve been listening video twice, and still will go to google...

[thechirpy_wanderer]

is there any way of doing the SSL pinning using which we can make changes in server-side only without making any changes in the app..so that we don't need to release the app with new certificate on the store when the certificate is expired?

[gopalsingh]

what if a hacker decompiles the apk and get the public key and all the api urls? Then the hacker will be allowed to connect to our server with his own app or not?

[nonnels]

Thanks, this video helped me, I needed a good way to explain what is, and way you should do certificate pinning.

[helterskelter]

This guy around 0:35 says that "it uses RSA to key exchange" and "SHA1 to sign messages". This is why you don't ask a Dev for crypto.

[mitenmehta]

can you also share some information on os level ssl pinning instead of inside apk or alike which considered app level. also things like CRS and Secure Element in context to ssl pinning.

[dilippatil]

Which method is most secure all of three public key or certificate or skpi...

[sanjujohn]

What will happen if the pinned key and server side key doesn't mach?
In my case the api calling is success if the keys aren't match.

[dilippatil]

could please provide a example for the android..

[tejal]

what is the use of CSRF token and what CSRF attack?

[rramani]

I don't get how cert pinning protects against MITM if the cert is indeed stolen ?

[Dhanapatimahato]

How do I implement HTTP public key pinning in JSP response.setHeader()?

[hipiri]

Speaker: What to do with my hands ?what to do with my hands...