3 ms·
Google doesn't do certificate pinning with HPKP. So nothing stopping a despot country from using certs signed by a valid CA. And of course there are compromised
by coenhyde 10y ago
Google doesn't do certificate pinning with HPKP. So nothing stopping a despot country from using certs signed by a valid CA. And of course there are compromised CA's. The US is just smart enough not to do this for mass collection, otherwise they'll get caught.
- Buge 10y agoIt seems that Google does public key pinning, but possibly only through preloaded lists in browsers such as Chrome and Firefox. This blog post mentions them catching a bogus google.com cert from a trusted root https://security.googleblog.com/2015/03/maintaining-digital-certificate-security.html https://security.googleblog.com/2015/03/maintaining-digital-... This says Google does use HPKP, but I don't see headers myself. https://calomel.org/http_public_key_pinning_hpkp.html https://calomel.org/http_public_key_pinning_hpkp.html
- coenhyde 10y agoInteresting. A search in chrome://net-internals/#hsts for Google does indeed show the public key pinning. I guess they do own Chrome and could get their public key hashes baked into other browsers too.