4 ms·
Like tptacek said, "Don't HPKP your blog". There's only a handful of sites that need HPKP and that's okay. That doesn't mean there is something wrong with HPKP
by ejcx 10y ago
Like tptacek said, "Don't HPKP your blog".
There's only a handful of sites that need HPKP and that's okay. That doesn't mean there is something wrong with HPKP. It's a useful tool for people with a specific threat model. If you are one of these sites then deploy HPKP and handle the operational responsibility that it comes with.
If you aren't one of these handful of sites then do not deploy HPKP. HPKP is a huge footgun and the benefits are not super large on an average case.
- ivanr 10y agoI think high profile sites are better served by static pinning, which seems simpler to maintain and also comes with the benefit of preloading. Thus, if you have those sites at one end, and lots of small/no-large-risk sites who don't need any pinning on the other end, you're left with no one for HPKP to serve in the middle. But, if HPKP were easier to deploy, perhaps more sites would use it.