3 ms·

I'm very curious to hear what the community thinks of the dangers outlined here. I've been hesitant about setting up HPKP before for small unimportant personal

I'm very curious to hear what the community thinks of the dangers outlined here. I've been hesitant about setting up HPKP before for small unimportant personal sites before since I have poor operational hygiene for them (I keep my machines patched so I don't get pwned but I have lost SSL keys before due to laziness or forgetfulness).

vbezhenar 9y ago
It's hard for me to justify a technology which could do very serious damage to a domain. I did the same, I set up HPKP for my domain and then I've lost my keys (I forget to pay for hosting and server was deactivated). It's not a big deal for me, I'm not really using this domain, but even with this throwaway site I've had problems, when I uploaded some file and sent link to my friend, but he wasn't able to download it, because he was there before. Blackmailing domain owners with HPKP is a real threat as well. It'll happen, sooner or later, servers are getting owned all the time. Defacing front page is visible. Setting additional header is not.
- Ajedi32 9y ago
  > I've lost my keys (I forget to pay for hosting and server was deactivated) Both of them? You mean you were storing your backup key on the same server the main key was on? Doesn't that kinda defeat the purpose of having a backup key in the first place?
  - skywhopper 9y ago
    Mistakes happen. New certs and keys can be easily acquired if you lose the key. But HPKP prevents you from fixing this simple mistake in order to guard against a problem that's extremely unlikely.
ivanr 9y ago
HPKP, in its current shape, is difficult to justify even to larger companies. Presumably, those companies who do consider it determined that there is a non-significant risk that they would be attacked via fraudulent (but of course valid) certificates. Given that unimportant sites don't face that risk, there's no reason to use HPKP for them.
skywhopper 9y ago
Essentially there's little or no likely gain in security or trust to be had by using HPKP, but you add a lot of risk to your operation if you do use it. It's like putting a nuclear bomb on a hair trigger in order to protect against the risk that mutant zombie rats will set up a lemonade stand in front of your McDonald's franchise: an overkill solution to an extremely unlikely threat.

vbezhenar 9y ago

It's hard for me to justify a technology which could do very serious damage to a domain. I did the same, I set up HPKP for my domain and then I've lost my keys (I forget to pay for hosting and server was deactivated). It's not a big deal for me, I'm not really using this domain, but even with this throwaway site I've had problems, when I uploaded some file and sent link to my friend, but he wasn't able to download it, because he was there before. Blackmailing domain owners with HPKP is a real threat as well. It'll happen, sooner or later, servers are getting owned all the time. Defacing front page is visible. Setting additional header is not.

Ajedi32 9y ago
> I've lost my keys (I forget to pay for hosting and server was deactivated) Both of them? You mean you were storing your backup key on the same server the main key was on? Doesn't that kinda defeat the purpose of having a backup key in the first place?
- skywhopper 9y ago
  Mistakes happen. New certs and keys can be easily acquired if you lose the key. But HPKP prevents you from fixing this simple mistake in order to guard against a problem that's extremely unlikely.

ivanr 9y ago

HPKP, in its current shape, is difficult to justify even to larger companies. Presumably, those companies who do consider it determined that there is a non-significant risk that they would be attacked via fraudulent (but of course valid) certificates. Given that unimportant sites don't face that risk, there's no reason to use HPKP for them.

skywhopper 9y ago

Essentially there's little or no likely gain in security or trust to be had by using HPKP, but you add a lot of risk to your operation if you do use it. It's like putting a nuclear bomb on a hair trigger in order to protect against the risk that mutant zombie rats will set up a lemonade stand in front of your McDonald's franchise: an overkill solution to an extremely unlikely threat.