News for hackers. Stuff that matters.

A comment on Life Is About to Get Harder for Websites Without HTTPS. Parent comment

Re:Life Is About to Get Harder for Websites Without HTTPS by phlo on Wednesday July 12, 2017 @07:29AM (#14751606)
Minor nitpick regarding the "except for certificate-pinned websites" part:

HPKP does not validate pins if they resolve to a user-installed trust anchor like an intranet CA. The RFC [1] leaves behavior undefined (see Section 2.4), and I'm not aware of any popular implementation that would honor the pin in case of a user-installed certificate.

This can be incredibly frustrating if you're trying to protect against MITM attacks; but at the same time, I can follow the browser developers' line of thought that goes "if we were to enforce it, users would just jump ship to the next available browser".

[1] https://tools.ietf.org/html/rfc7469

[ Parent | on HN ]
Re:Life Is About to Get Harder for Websites Without HTTPS by cesarb on Wednesday July 12, 2017 @10:07AM (#14752600)
At least on firefox, this can be changed through the preference security.cert_pinning.enforcement_level (see https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...).
[ Parent | on HN ]