3 ms·
Is there a way to mitigate the risk of automated PKP ransom attacks without just pinning yourself before they find you? My impression after reading this is that
by bulatb 10y ago
Is there a way to mitigate the risk of automated PKP ransom attacks without just pinning yourself before they find you? My impression after reading this is that the mere existence of HPKP (as implemented) forces you to either use it or be ready to go down for 60+ days if you get owned.
- bulatb 10y agoOops. The article mentioned fronting your servers with a proxy that strips the HPKP header. Not perfect, but it's something.