News for hackers. Stuff that matters.

A comment on Is HTTP Public Key Pinning Dead?.

Re:Is HTTP Public Key Pinning Dead? by Tergmap on Tuesday September 06, 2016 @08:50AM (#12435557)
He says "bricking your website" while he means "your website will appear as if it has an invalid certificate".

Bricking means to crash something beyond repair.

[ Parent | on HN ]
Re:Is HTTP Public Key Pinning Dead? by ivanr on Tuesday September 06, 2016 @08:55AM (#12435581)
No, when HPKP breaks your site no longer works, period. The error page doesn't allow clicking through. Some browsers (e.g., Chrome) support manual editing of the HPKP configuration so some users might be able to get around the problem, but that's unlikely to work for many.

Try it here: https://pinning-test.badssl.com

[ Parent | on HN ]
Re:Is HTTP Public Key Pinning Dead? by agrajag on Tuesday September 06, 2016 @09:43AM (#12435921)
Most users won't click through on a prompt that a website is insecure though. For that majority of users the website is well and truly "broken beyond repair".

The only thing that matters is what your users experience, not what your server serves.

[ Parent | on HN ]