5 ms·
Do i remember correctly that Chrome wanted to deprecate HSTS about a year ago? What happened with that?
by faeyanpiraat 7y ago
Do i remember correctly that Chrome wanted to deprecate HSTS about a year ago?
What happened with that?
- recrudesce 7y agoYou're thinking of HPKP https://raymii.org/s/blog/Chrome_68_is_deprecating_HPKP.html https://raymii.org/s/blog/Chrome_68_is_deprecating_HPKP.html
- kadoban 7y agoWhich is a shame really. I understand why they're doing it, it's stressful as hell to configure, since if you do it really wrong you might as well just write off your domain name, but the extra assurance was nice.
- vbezhenar 7y agoIMO browsers should just use TLSA records instead. They already starting to use DoH, so DNS is secure even without DNSSEC.
- xorcist 7y agoIt's less bad, but far from secure seeing it is not end-to-end encrypted.
- vbezhenar 7y agoA simple solution is just to forbid http altogether. No properly encrypted HTTPS connection - no website, sorry (unless you downloaded some kind of firefox developer build). But we're not there yet.
- wielebny 7y agoNot only it is stressful to configure, it can be used to hold your domain at ransom.