4 ms·
Key pinning could do a little towards preventing MITM, but implementing it is dangerous - in fact the whole standard is dangerous. Smashing Magazine went live
by Steeeve 10y ago
Key pinning could do a little towards preventing MITM, but implementing it is dangerous - in fact the whole standard is dangerous. Smashing Magazine went live with it, then had a cert expire before their max-age header did - rendering their site unavailable to repeat visitors. Then there are attacks like pkpransom to deal with, or the fact that Chrome doesn't implement hpkp properly.
Only ~400 sites actually implement pinning. It's going to be more of a security problem than a security solution in the next couple of years.