Re:Public Key Pinning Being Removed from Chrome
by geofft on Friday October 27, 2017 @05:25PM
(#15572352)
... isn't the risk that HPKP mitigates the risk of a MITM attack in case some other CA gets breached?
[ Parent
| on HN ]
Re:Public Key Pinning Being Removed from Chrome
by detaro on Friday October 27, 2017 @05:30PM
(#15572382)
HPKP also protects against your CA if you pin the direct private keys your servers use, but I bet it also is quite annoying to come up with a good plan for how you are not going to loose/delete all the private keys you have pinned...
Re:Public Key Pinning Being Removed from Chrome
by geofft on Friday October 27, 2017 @05:39PM
(#15572434)
Right. I'm curious which approach the auditors wanted - either one would be a weird thing to mandate!
In theory, pinning your servers' private keys is actually kind of reasonable, if you generate like two or three sets of backup private keys and put them in off-site storage. And I've long been an advocate of buying at least one backup certificate from another CA just in case your current one gets distrusted.
(And it makes sense from a technical perspective why HPKP supports both of these approaches, but the ambiguity probably didn't help it from a policy perspective).