3 ms·
Lots of good HPKP discussion on infosec twitter as a result of this article. I agree that HPKP in enforce mode is too dangerous to be valuable, but running HPK
by arkadiyt 9y ago
Lots of good HPKP discussion on infosec twitter as a result of this article.
I agree that HPKP in enforce mode is too dangerous to be valuable, but running HPKP in report-only mode can be an effective canary against (poorly executed) MITM attacks or other accidental server/router/ISP/etc misconfigurations.