4 ms·
Chrome users should be protected from this by the public key pinning feature [http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.or
by vilhelm_s 15y ago
Chrome users should be protected from this by the public key pinning feature [http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html], right?
- ajross 15y agoSounds like it. But this isn't an architectural solution. All this does is layer an additional level of "trust" requirements onto the existing protocol. The "pinning whitelist" is isomorphic to the root CA list and can be compromised in exactly the same way.