News for hackers. Stuff that matters.

A comment on Is HTTP Public Key Pinning Dead?. Parent comment

Re:Is HTTP Public Key Pinning Dead? by zrm on Tuesday September 06, 2016 @11:17AM (#12436593)
You could do that on the client side too though. Have the clients refuse to long-term pin anything until they've seen it multiple times over multiple days.
[ Parent | on HN ]
Re:Is HTTP Public Key Pinning Dead? by Strilanc on Wednesday September 07, 2016 @02:02PM (#12445581)
Doing it client-side defeats the purpose of certificate pinning. Three years after you rolled out pinning, new users would still be using max ages that were clamped too low.
[ Parent | on HN ]