4 ms·

Browsers do this by default, unfortunately.

conradev 10y ago
Not Chrome, since 2011: https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html
- tinix 10y ago
  Why do people keep linking to posts from 2011? That is wholly irrelevant... not only is key pinning not done that way now, we have a standard for this. https://www.rfc-editor.org/rfc/rfc7469.txt https://www.rfc-editor.org/rfc/rfc7469.txt And it's implemented by most browser vendors... just not Microsoft, of course. https://developer.microsoft.com/en-us/microsoft-edge/platform/status/publickeypinningextensionforhttp/ https://developer.microsoft.com/en-us/microsoft-edge/platfor...
  - jsmthrowaway 10y ago
    > Why do people keep linking to posts from 2011? Because it was an accurate response to the question to point out that Chrome hasn't done it for five years?
kentonv 10y ago
Google's certificates are statically pinned in at least Chrome and Firefox. https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#Implementation_status https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...
- tinix 10y ago
  Those links are incredibly outdated, in internet time. https://tools.ietf.org/html/rfc7469 https://tools.ietf.org/html/rfc7469 https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...
  - pauldino 10y ago
    Independent of HPKP Chrome still does 2011-style static pinning AFAIK and just by looking at HTTP headers I don't think google.com even uses HPKP. Unlike HPKP which is trust-on-first-use, static pinning is enforced from the very start so if you have the ability to statically pin in the client (as you would if you're a browser vendor or distributing your own mobile app) you probably should. And then there is this recent discussion: https://news.ycombinator.com/item?id=12434585 https://news.ycombinator.com/item?id=12434585
- sneak 10y ago
  I don't use either of those as http clients in my idiotic hobby projects that lookup DNS over TLS/HTTP.
kazinator 10y ago
DNS-over-HTTPS resolvers aren't browsers, in any case.
- oxc 10y ago
  No, but the service seems to be (at least partly) targeted at "web-based applications", so the https clients would be browsers. Which would in turn mean the resolver would be using the browser's pinned certificates.

Not Chrome, since 2011: https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html

tinix 10y ago
Why do people keep linking to posts from 2011? That is wholly irrelevant... not only is key pinning not done that way now, we have a standard for this. https://www.rfc-editor.org/rfc/rfc7469.txt https://www.rfc-editor.org/rfc/rfc7469.txt And it's implemented by most browser vendors... just not Microsoft, of course. https://developer.microsoft.com/en-us/microsoft-edge/platform/status/publickeypinningextensionforhttp/ https://developer.microsoft.com/en-us/microsoft-edge/platfor...
- jsmthrowaway 10y ago
  > Why do people keep linking to posts from 2011? Because it was an accurate response to the question to point out that Chrome hasn't done it for five years?

kentonv 10y ago

Google's certificates are statically pinned in at least Chrome and Firefox. https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning#Implementation_status https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...

tinix 10y ago
Those links are incredibly outdated, in internet time. https://tools.ietf.org/html/rfc7469 https://tools.ietf.org/html/rfc7469 https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...
- pauldino 10y ago
  Independent of HPKP Chrome still does 2011-style static pinning AFAIK and just by looking at HTTP headers I don't think google.com even uses HPKP. Unlike HPKP which is trust-on-first-use, static pinning is enforced from the very start so if you have the ability to statically pin in the client (as you would if you're a browser vendor or distributing your own mobile app) you probably should. And then there is this recent discussion: https://news.ycombinator.com/item?id=12434585 https://news.ycombinator.com/item?id=12434585
sneak 10y ago
I don't use either of those as http clients in my idiotic hobby projects that lookup DNS over TLS/HTTP.

kazinator 10y ago

DNS-over-HTTPS resolvers aren't browsers, in any case.

oxc 10y ago
No, but the service seems to be (at least partly) targeted at "web-based applications", so the https clients would be browsers. Which would in turn mean the resolver would be using the browser's pinned certificates.