3 ms·
> I'd expect I'm not the only one who wants to pin few certs for sites that I visit frequently. How can you tell what the backup pin for those websites would b
by hobarrera 11y ago
> I'd expect I'm not the only one who wants to pin few certs for sites that I visit frequently.
How can you tell what the backup pin for those websites would be without the owner publishing the HKPK headers? How do you know the max-age of their current pin?
It sound a bit like trying to stuff things into the browser's cache - a road to disaster.
- eps 11y agoI control these sites.
- garrettr_ 11y agoIf you control the sites, just modify their server configuration so they send the HPKP header. If you don't control the sites, it is not a good idea to pin them "from the browser" as you suggest.
- hobarrera 11y agoYou can get their certs pinned into your browser by adding the HKPK header to them. It'll also mitigate risks for your other visitors (if any; may not be a public site).