4 ms·
Yes, this is exactly the thing that HPKP would prevent from happening.
by pfg 10y ago
Yes, this is exactly the thing that HPKP would prevent from happening.
- tyingq 10y agoNot supported in IE or Edge though, right? So it would still catch some end users. Banrisol currently has a message up on their home banking portal that Firefox isn't supported.
- pfg 10y agoThat's right, they don't have a pinning mechanism for site operators. They have something called Certificate Reputation[1] which works alongside SmartScreen and should theoretically be of use for attacks like this, but I haven't heard much about it and I don't know if it helped here. [1]: https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-reputation-a-novel-approach-for-protecting-users-from-fraudulent-certificates/ https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-r...