thunderbird / thunderbird/thunderbird-android
Implement SSL certificate pinning
Nobody has claimed this yet.
- Dominant language
- Kotlin
- Stars
- 14k
- Forks
- 2.8k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 57
Description
In many cases mobile devices are frequently used in foreign and thus more or less completely untrusted (wireless) networks. Therefore I would very much appreciate it if K9 would support SSL certificate pinning to prevent against MITM attacks using forged SSL certificates. Preferably, in my opinion, certificate pinning should be active by default. Alternatively it could become an option, activatable by the user.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files, tests, or entry points. Begin by locating the Android networking and certificate-validation paths, then clarify whether pinning is mandatory or user-configurable. Done means the chosen policy is implemented for the supported network paths and verified against forged certificates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, kotlin
- Domain
- mobile, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100