News for hackers. Stuff that matters.

A comment on Is HTTP Public Key Pinning Dead?. Parent comment

Re:Is HTTP Public Key Pinning Dead? by Strilanc on Tuesday September 06, 2016 @09:08AM (#12435685)
Server software might be able to help with some of the foot-gunning mentioned in Scott Helme's writeup. For example, web servers that were just configured to do cert pinning for the first time could default to giving a 5-hour grace period where the max-age was clamped below a day, followed by a 2-day grace period where the max-age was clamped below a week. Problems are likely to show up immediately, so starting with a low max-age makes sense.

This wouldn't help with malicious scenarios though; attackers would just disable the grace period.

[ Parent | on HN ]
Re:Is HTTP Public Key Pinning Dead? by zrm on Tuesday September 06, 2016 @11:17AM (#12436593)
You could do that on the client side too though. Have the clients refuse to long-term pin anything until they've seen it multiple times over multiple days.
[ Parent | on HN ]
Re:Is HTTP Public Key Pinning Dead? by Strilanc on Wednesday September 07, 2016 @02:02PM (#12445581)
Doing it client-side defeats the purpose of certificate pinning. Three years after you rolled out pinning, new users would still be using max ages that were clamped too low.
[ Parent | on HN ]