Re: [saag] On PKI vs. Pinning (SAAG 108 preview)

[Stephen Farrell <[e-mail]>]

On 29/08/2020 00:02, Michael Richardson wrote:
> What happens if there is an official MITM installed on the phone,
> and the phone is in that "Enterprise"?
> I assume it doesn't work, but what does the app *do*?

I believe the intent is that an enterprise MITM ought
not see that a person has tried to upload keys as a
result of a positive COVID test (that being sensitive
medical information) and so the app would fail to connect
to the public health authority services whilst being
MITM'd. I don't know what the UI would display in that
case as we didn't do any tests of the upload features,
as that could in theory interfere with a live service.

For the regular download (every ~2 hours), I'd have to
re-do the test to be sure, but IIRC, the app didn't
display anything to the user, just the same as if the
n/w weren't up at that time. (Pinning for the download
isn't as big a deal though as the data retrieved is
signed at the application layer so it could be ok
if some of the apps don't enforce pins for downloads.)
Most of these apps are open-source though so you
could figure it out if it mattered.

Cheers,
S.

PS: I know what you meant but "official MITM" is a bit
of a yukkie term;-)