Certificate and public key pinning: when do you need it and what are the risks?
Essence
Regular TLS validation trusts any certificate issued by a trusted certificate authority (CA) for the right name. Pinning narrows that trust: the app accepts only a known certificate or public key. It protects against MITM when an attacker can obtain a certificate the system considers "real": through a compromised CA, a corporate proxy, or a root certificate the user was talked into installing.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep