3 ms·
What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert
by bonyt 8y ago
What ever happened to HPKP? It seems like that would somewhat mitigate these attacks since they rely on using their control over the domain to get a new DV cert. A pinned certificate would at least protect those who have accessed the sites before.
- mh- 8y agoDeprecated/killed. https://www.chromestatus.com/feature/5903385005916160 https://www.chromestatus.com/feature/5903385005916160
- moosingin3space 8y agoIf you're confused as to why, this article was illuminating: https://scotthelme.co.uk/using-security-features-to-do-bad-things/ https://scotthelme.co.uk/using-security-features-to-do-bad-t...
- tptacek 8y agoHPKP was underdesigned; it was a protocol evolution of something Google was already doing semi-manually. There was a competing initiative inside Google --- certificate transparency --- and that won out. There's validity in the approach and I hope it comes back sometime, maybe with additional mechanism around managing pins.
- dcbadacd 8y agoIs HPKP Report Only also being deprecated?
- duskwuff 8y agoHPKP could have potentiated these attacks by allowing an attacker to pin their certificate while they were in control of the domain, making it difficult for the domain owner to ever fully regain control.
- ufmace 8y agoBeing widely phased-out due to being too risky and error-prone. Attacks like this get a lot of media attention, but are pretty rare overall. It's much more common for someone to handle certificates and servers badly somehow, ending up in locking all of your visitors out of your own site, or you never bother with it, but the attacker who takes over your domain does, once again basically hijacking your domain name indefinitely. I never set it up for any of my sites for the same reason, just too many ways for it to go wrong.