3 ms·
Who can break it with HKPK enabled?
by jdc 8y ago
Who can break it with HKPK enabled?
- schoen 8y agoNote that HPKP enforcement is being dropped as a mainstream browser feature, so we may not be able to rely on this particular argument much in the future. (Although an attacker might not know for sure whether some target might not still be enforcing a pin, presumably not many sites will keep announcing pins at some point.)
- Avamander 8y agoIt's really a pity they're removing the functionality. Would it be possible to have a browser extension enforce it?
- schoen 8y agoThat would be interesting. It sounds like the deprecation became effective and Chrome stopped enforcing it just two weeks ago. I don't know whether Chrome provides appropriate extension APIs to allow an extension to do this, but I have a number of colleagues who work on browser extension development whom I could ask.