Hijack of Amazon’s domain service used to reroute web traffic for two hours

Re:Hijack of Amazon’s domain service used to reroute web tra... by web007 on Tuesday April 24, 2018 @04:44PM (#16916393)

I thought HPKP was essentially deprecated - too many footgun scenarios and not enough specificity on "what to pin" since CAs can use / issue with multiple intermediates.

[ Parent | on HN ]

Re:Hijack of Amazon’s domain service used to reroute web tra... by Kalium on Tuesday April 24, 2018 @06:34PM (#16917250)

There are definitely a series of foot-gun-y scenarios with HPKP, just as with full DNSSEC. It's just one of the few things I can think of that gives you the ability to detect when a cert has changed unexpectedly.

[ Parent | on HN ]