Public Key Pinning Being Removed from Chrome

Re:Public Key Pinning Being Removed from Chrome by saas_co_de on Friday October 27, 2017 @07:48PM (#15573167)

I agree that the utility of this feature would be limited to a small percent of users for a small percent of cases.

The SSH example comes to mind because that is a system that does something similar.

In my experience every single SSH error on a key change has been a false positive but everyone accepts the high false positive rate because it is worth it to detect that one case where you are actually compromised.

[ Parent | on HN ]

Re:Public Key Pinning Being Removed from Chrome by daira on Saturday October 28, 2017 @08:47AM (#15574975)

But you don't detect that one case where you are actually compromised. You dismiss it like you do all the false positives. At best, when you get pwned you think back to having dismissed the key change warning and know what happened, but how does that actually help you?

[ Parent | on HN ]

Re:Public Key Pinning Being Removed from Chrome by scott00 on Saturday October 28, 2017 @10:38AM (#15575270)

I actually caught a semi-real one once. My new employer was MITMing all ssh traffic.

[ Parent | on HN ]

Re:Public Key Pinning Being Removed from Chrome by saas_co_de on Saturday October 28, 2017 @02:36PM (#15576175)

this does not follow at all. any time a cert has changed i either know the cause or verify the cause before using the server.

[ Parent | on HN ]