News for hackers. Stuff that matters.

A comment on Public Key Pinning Being Removed from Chrome. Parent comment

Re:Public Key Pinning Being Removed from Chrome by lmm on Saturday October 28, 2017 @11:37AM (#15575456)
HPKP can, if you pin a key and then lose the key you pinned.
[ Parent | on HN ]
Re:Public Key Pinning Being Removed from Chrome by Buge on Sunday October 29, 2017 @04:06AM (#15578458)
I know. But you shouldn't lump the dangerousness of HPKP on HSTS.

Also with HPKP you shouldn't just pin one key. You should pin several keys you own as well as several root and intermediate keys. But I agree it's very difficult to do right and there's still a risk of it failing.

[ Parent | on HN ]