News for hackers. Stuff that matters.
Re:PiHole-Google: Completely Block Google and Its Services by edf13 on Sunday June 30, 2019 @10:39AM (#20318423)
Won’t work for Google as their Cets are pinned
Re:PiHole-Google: Completely Block Google and Its Services by Gregordinary on Sunday June 30, 2019 @10:58AM (#20318534)
Not sure about other browsers, but Chrome will ignore certificate pins if the cert provided chains to local trust anchor.

From: http://www.chromium.org/Home/chromium-security/security-faq#...

"Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. “Data loss prevention” appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

We deem this acceptable because the proxy or MITM can only be effective if the client machine has already been configured to trust the proxy’s issuing certificate — that is, the client is already under the control of the person who controls the proxy (e.g. the enterprise’s IT administrator). If the client does not trust the private trust anchor, the proxy’s attempt to mediate the connection will fail as it should."

Re:PiHole-Google: Completely Block Google and Its Services by cpach on Monday July 01, 2019 @09:08AM (#20324859)
Does anyone know how Chrome does do distinguish a private trust anchor from all the other root certificates that are provided by the operating system? (Comodo, Comsign, Digicert et al)