3 ms·
Scott, so take HPKP out of your securityheaders.io site. Encouraging people to deploy this extremely sharp tool can bring only bad results.
by hdhzy 9y ago
Scott, so take HPKP out of your securityheaders.io site. Encouraging people to deploy this extremely sharp tool can bring only bad results.
- GlitchMr 9y agoHe did, on test.securityheaders.io. The change probably will move to actual site (non-test version of it) soonish.
- hdhzy 9y agoExcellent! That also shows damage that can be done by people blindly perusing A+/100% on security tests. The same goes to ssllabs that needs 4096 bit RSA keys (or equivalent) to get 100%. Just... a bad idea.