3 ms·

Thank you for the clarification. As a site operator, how should we assure that a visitor's connection cannot be MitM'd? Is this why some apps only use their own

Thank you for the clarification. As a site operator, how should we assure that a visitor's connection cannot be MitM'd? Is this why some apps only use their own internal trusted certificate list, in lieu of offering a webpage? Can't they inform the HKPK list provider to revoke the old key after they regain control of the domain?

dwattttt 4y ago
HPKP isn't a centrally managed list, it's remembered by clients who've received HPKP headers when visiting your site (or in this case, the attacker controlled site at your domain).
zinekeller 4y ago
As dwattttt said, it's not a central list at all. Having a central list defeats the purpose of HPKP (since that governments can just force them to add another authorized key, and even if they only have remove-only policies I'm pretty sure that stripping HPKP defeats its own purpose).