3 ms·

Google's certificates are statically pinned in at least Chrome and Firefox. https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.o

• tinix 10y ago
  Those links are incredibly outdated, in internet time. https://tools.ietf.org/html/rfc7469 https://tools.ietf.org/html/rfc7469 https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...
  • pauldino 10y ago
    Independent of HPKP Chrome still does 2011-style static pinning AFAIK and just by looking at HTTP headers I don't think google.com even uses HPKP. Unlike HPKP which is trust-on-first-use, static pinning is enforced from the very start so if you have the ability to statically pin in the client (as you would if you're a browser vendor or distributing your own mobile app) you probably should. And then there is this recent discussion: https://news.ycombinator.com/item?id=12434585 https://news.ycombinator.com/item?id=12434585
• sneak 10y ago
  I don't use either of those as http clients in my idiotic hobby projects that lookup DNS over TLS/HTTP.