Protecting traffic.
WHAT IS ENFORCED BY DEFAULT
Encrypted connections, with plain traffic blocked.
WHAT TO NEVER DO
Add exceptions permitting plain traffic for convenience.
WHY
Exceptions are frequently left in release builds, and review questions them.
WHAT TO DO INSTEAD
Fix the server.
WHAT CERTIFICATE PINNING PROVIDES
Restricting which certificates are accepted beyond the normal chain.
WHAT IT PROTECTS AGAINST
Interception using a certificate the device otherwise trusts.
WHAT IT RISKS
An application that stops working when certificates rotate, fixable only by an update.
WHAT TO WEIGH
Whether the threat justifies that operational risk.
WHAT TO IMPLEMENT IF USED
Backup pins, a rotation plan, and a way to disable it remotely.
WHAT TO KNOW ABOUT PROXIES
Intercepting traffic for debugging requires installing a trusted certificate, which users can also be persuaded to do.
WHAT THAT MEANS
Assume traffic can be inspected on a device the user controls.
WHAT FOLLOWS
Never rely on traffic being secret from the device's owner.
WHAT TO VALIDATE
Every response, rather than assuming its shape.
