Re:What You Need to Know about HTTP Public Key Pinning (HPKP)
by tptacek on Sunday February 07, 2016 @12:31PM
(#11053724)
In addition to the other comments on this subthread, a point I think is worth making:
If you're providing both an app and a server for the app to talk to you, you control both ends of the TLS connection and can pin however you'd like; you're not limited to HPKP and key-continuity. Secure apps have been doing custom pins of TLS keys long before HPKP got rolled out.
If you're providing both an app and a server for the app to talk to you, you control both ends of the TLS connection and can pin however you'd like; you're not limited to HPKP and key-continuity. Secure apps have been doing custom pins of TLS keys long before HPKP got rolled out.