The link points to version 20 (August 2014) of the draft, a more current version 21 (October 2014) is available at [1], linked in the article. Chrome has been

The link points to version 20 (August 2014) of the draft, a more current version 21 (October 2014) is available at [1], linked in the article. Chrome has been doing public key pinning out of the box for about three years now, though the feature has only been active for some Google properties and a couple of hand-picked high-profile sites [2]. Firefox has recently added support for static pins, plans to support the HTTP extensions exist [3]. Alternative or complementary proposals include DANE/TLSA [4] (DNS-based Authentication of Named Entities; stores certificate infos for any protocols in a new DNS record; requires DNSSEC) and TACK [5] (Trust Assertions for Certificate Keys; a similar mechanism to the one proposed in this draft but implemented as a TLS extension; possibly discontinued). [1] https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21 https://tools.ietf.org/html/draft-ietf-websec-key-pinning-21 [2] https://www.imperialviolet.org/2011/05/04/pinning.html https://www.imperialviolet.org/2011/05/04/pinning.html [3] https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn... [4] https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... [5] http://tack.io http://tack.io