3 ms·

> > the ability for sites with low security requirements to opt out of HPKP. > opt out?! It's off by default. I think tptacek meant that a site owner should b

by pcl 10y ago

> > the ability for sites with low security requirements to opt out of HPKP. > opt out?! It's off by default. I think tptacek meant that a site owner should be able to explicitly declare that nobody should be able to pin a key, so that nobody can hijack the site in the future.

nsgi 10y ago
An opt-in would make more sense, since people using HPKP are those that know the most about it. Just like an opt-out, it would have to be via a different channel than HTTP headers.
jb613 10y ago
Fine, but take note that leaves the door open for others to get a cert for your domain.