I've been running Firefox with CertPatrol add-on and if there's one take away is that simple client-side pinning generates so much noise that it conditions you

I've been running Firefox with CertPatrol add-on and if there's one take away is that simple client-side pinning generates so much noise that it conditions you into completely ignoring any certificate changes. Way, way too many websites either change their certs regularly or they use a CDN (and sometimes more than one) so that the page ends up getting a different cert on virtually every load. The most obvious example is Twitter's web interface - I am not a heavy user, but I still need to click through a dozen certificate changes per day. TACK is certainly a must-have and I'm really looking forward it being a native part of browsers, but there will still be likely a lot of (high-profile) websites that won't play along :-/ [0] http://patrol.psyced.org http://patrol.psyced.org