> Pinning is what is done by sites like gmail to prevent third world dictatorships from using stolen certificate credentials to spy on their citizens. People wh

> Pinning is what is done by sites like gmail to prevent third world dictatorships from using stolen certificate credentials to spy on their citizens. People who have been victims of this have had their email read, been arrested by state security forces for dissent, and have been tortured to death for lack of certificate pinning working in their browsers. Well, this is awkward - Chrome has deprecated HPKP in favor of a new header: 'Expect-CT' [1]. The new header requires any cert to have a valid certificate transparency log entry and has reporting features as well [2]. This is slightly different - the scenario above would be allowed to happen and would be be valid, but that it would be logged publicly. Whatever CA (dictatorships) had issued the cert would lose their trusted status. But then again, if you have a dictatorship, then you can require that your CA remains trusted and the burden of removing trust to your dictatorship CA would be on individual users. [1]: https://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/ https://www.zdnet.com/article/google-chrome-is-backing-away-... [2]: https://scotthelme.co.uk/a-new-security-header-expect-ct/ https://scotthelme.co.uk/a-new-security-header-expect-ct/