28 ms·
The article did mention this but I will re-iterate that mobile apps can benefit a lot from key pinning. That's a huge chunk of total internet activity. So, not
by mkagenius 10y ago
The article did mention this but I will re-iterate that mobile apps can benefit a lot from key pinning. That's a huge chunk of total internet activity. So, not that dead if you ask me.
The scenario of attacker having root(?) access to the machine warrants much bigger (or equal) concern than bricking your website in my opinion.
- ivanr 10y agoJust to clarify: in my article I discuss mostly HPKP as defined in RFC 7469. I think static pinning works great (and also has the benefit of being preloaded). Mobile and other types of pinning where you control both sides of a conversation also work well and are easier to get right.