2 ms·
Those links are incredibly outdated, in internet time. https://tools.ietf.org/html/rfc7469 https://tools.ietf.org/html/rfc7469 https://en.wikipedia.org/wiki/H
by tinix 10y ago
Those links are incredibly outdated, in internet time.
https://tools.ietf.org/html/rfc7469 https://tools.ietf.org/html/rfc7469
https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
https://bugzilla.mozilla.org/show_bug.cgi?id=787133 https://bugzilla.mozilla.org/show_bug.cgi?id=787133
https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning https://developer.mozilla.org/en-US/docs/Web/Security/Public...
- pauldino 10y agoIndependent of HPKP Chrome still does 2011-style static pinning AFAIK and just by looking at HTTP headers I don't think google.com even uses HPKP. Unlike HPKP which is trust-on-first-use, static pinning is enforced from the very start so if you have the ability to statically pin in the client (as you would if you're a browser vendor or distributing your own mobile app) you probably should. And then there is this recent discussion: https://news.ycombinator.com/item?id=12434585 https://news.ycombinator.com/item?id=12434585