> I find Palmer's assertion to be flawed and full of hyperbole and misdirection yes, we wouldn't want to be hyperbolic, would we. > This is like saying that b

> I find Palmer's assertion to be flawed and full of hyperbole and misdirection yes, we wouldn't want to be hyperbolic, would we. > This is like saying that because perfect security is impossible, all security measures are futile No, it's saying security theater is just that, and there would be significant downsides for the stated gain. Where you and he disagree is the magnitude of that gain. You're well within your right to disagree on that, but seriously, let's refrain from being so hyperbolic. It's not like this was unexpected. This has been noted for years in their security FAQ: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq... It was also extensively discussed when the Lenovo/Superfish incident happened. It's also notable that no other browser will reject a connection based on a differing certificate to the pinned one, either, so it's not clear why Chrome is being singled out here. Firefox was only immune here because they don't use the OS's cert store. Superfish happily just injected its certificates in their's too.