Re:What You Need to Know about HTTP Public Key Pinning (HPKP)
by hobarrera on Sunday February 07, 2016 @06:48PM
(#11055598)
> I'd expect I'm not the only one who wants to pin few certs for sites that I visit frequently.
How can you tell what the backup pin for those websites would be without the owner publishing the HKPK headers? How do you know the max-age of their current pin?
It sound a bit like trying to stuff things into the browser's cache - a road to disaster.
Re:What You Need to Know about HTTP Public Key Pinning (HPKP)
by eps on Monday February 08, 2016 @05:32AM
(#11057347)
I control these sites.
Re:What You Need to Know about HTTP Public Key Pinning (HPKP)
by garrettr_ on Monday February 08, 2016 @10:40AM
(#11058663)
If you control the sites, just modify their server configuration so they send the HPKP header.
If you don't control the sites, it is not a good idea to pin them "from the browser" as you suggest.
1. View pinned certificates/keys?
2. Pin one manually, from the browser?
From what I understand neither is possible, even though this was added to Firefox 1.5 years ago. Which really makes you go Hmm. I'd expect I'm not the only one who wants to pin few certs for sites that I visit frequently.