3 ms·
I don’t believe any modern browser supports HPKP any more, due to how hard it was to set up and operate.
by mgdm 5y ago
I don’t believe any modern browser supports HPKP any more, due to how hard it was to set up and operate.
- LinuxBender 5y agoThey still honor it. I have to tell squid which domains to not MITM because some of Google's sub-domains, paypal, the EFF and a few others still use it.
- toast0 5y agoI suspect all of those pins are from preloading (arranged by request with Chrome maintainers) and not HPKP. HPKP was supposed to allow for similar security after first use, without needing to interact with maintainers and wait for a browser release, but because of the probability of shooting your own foot, usage was extremely low and it was on the path to removal, last I checked.