4 ms·
noob question: is there not a way for the client to verify that it is actually talking to google.com in a situation like this? I would think there would be some
by kingds 4y ago
noob question: is there not a way for the client to verify that it is actually talking to google.com in a situation like this? I would think there would be some way to verify based on certs or something like that.
- maicro 4y agoNoob answer - yeah, that's what I'm talking about, there's certain levels of faking those responses that you can't really do.
- dec0dedab0de 4y agoyes, cert pinning, DNS over https, and encrypted DNS can make it much harder to see what the software on your network is doing. even just verifying ssl certificates client side is enough in most instances. Luckily, proxy servers in corporate environments have forced many vendors into not fully implementing these features.
- deleted 4y ago[deleted]
- _V_ 4y agoIf you want to be sure, you have to pin your TLS certificates. That way someone either has to decompile your executable and replace that pinned cert (hard if you use SW signing), crack your signature (not likely) or steal your private key. There are several other methods that I've seen but they are not bulletproof: - talking directly to hardcoded DNS such as 8.8.8.8 - hardcoding IP addresses into SW - Checking for some obscure header as a part of client/server identification