4 ms·
> Not if you need to serve https traffic to clients and browsers from the same servers / same hostnames That's what I was getting at, that makes sense to me.
by jcalvinowens 3y ago
> Not if you need to serve https traffic to clients and browsers from the same servers / same hostnames
That's what I was getting at, that makes sense to me.
> That comes from HSTS, not from cert pinning.
HSTS is a terrible half assed solution that relies on adding domains to magical predistributed lists. I wouldn't trust it if I cared enough about MITM to go to all this trouble.
- toast0 3y ago> HSTS is a terrible half assed solution that relies on adding domains to magical predistributed lists. I wouldn't trust it if I cared enough about MITM to go to all this trouble. Sure, but cert pinning in browsers is done with the same magical redistributed lists; it's just even harder to get them changed.