3 ms·
HSTS already protects you from attackers that get another CA to sign their certificate. There would be obvious problems with encouraging you as a user manage p
by thefifthsetpin 9y ago
HSTS already protects you from attackers that get another CA to sign their certificate.
There would be obvious problems with encouraging you as a user manage pinning (how would you know whether a site will deviate from what you pinned?) If you understand that but want to pin as a user anyway, chrome will let you do that:
chrome://net-internals/#hsts
- snakeanus 9y ago>chrome will let you do that: chrome://net-internals/#hsts Aren't the hashes there only for the public keys of the site instead of the public key of the CA? Also, does anybody happens to know any extension for Firefox that does anything similar to that?
- wolfgang42 9y agoI think that's HPKP you're thinking of; HSTS only declares that the site plans to continue requiring HTTPS without specifying a CA or public key that it will use.