What You Need to Know about HTTP Public Key Pinning (HPKP)

Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by hobarrera on Sunday February 07, 2016 @06:48PM (#11055598)

> I'd expect I'm not the only one who wants to pin few certs for sites that I visit frequently.

How can you tell what the backup pin for those websites would be without the owner publishing the HKPK headers? How do you know the max-age of their current pin?

It sound a bit like trying to stuff things into the browser's cache - a road to disaster.

[ Parent | on HN ]

Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by eps on Monday February 08, 2016 @05:32AM (#11057347)

I control these sites.

[ Parent | on HN ]

Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by garrettr_ on Monday February 08, 2016 @10:40AM (#11058663)

If you control the sites, just modify their server configuration so they send the HPKP header.

If you don't control the sites, it is not a good idea to pin them "from the browser" as you suggest.

[ Parent | on HN ]

Re:What You Need to Know about HTTP Public Key Pinning (HPKP) by hobarrera on Tuesday February 09, 2016 @03:49AM (#11064012)

You can get their certs pinned into your browser by adding the HKPK header to them. It'll also mitigate risks for your other visitors (if any; may not be a public site).

[ Parent | on HN ]