Everything you Need to Know about HTTP Public Key Pinning (HPKP): http://blog.rlove.org/2015/01/public-key-pinning-hpkp.html http://blog.rlove.org/2015/01/publi

Everything you Need to Know about HTTP Public Key Pinning (HPKP): http://blog.rlove.org/2015/01/public-key-pinning-hpkp.html http://blog.rlove.org/2015/01/public-key-pinning-hpkp.html > A flaw in this system is that any compromised root certificate can in turn subvert the entire identity model. If I steal the Crap Authority's private key and your browser trusts their certificate, I can forge valid certificates for any website. In fact, I could execute this on a large scale, performing a man-in-the-middle (MITM) attack against every website that every user on my network visits. Indeed, this happens. > HPKP is a draft IETF standard that implements a public key pinning mechanism via HTTP header, instructing browsers to require a whitelisted certificate for all subsequent connections to that website. This can greatly reduce the surface area for an MITM attack: Down from any root certificate to requiring a specific root, intermediate certificate, or even your exact public key. related previous articles: Firefox 32 Supports Public Key Pinning (188 points by jonchang 304 days ago | 100 comments): https://news.ycombinator.com/item?id=8230690 https://news.ycombinator.com/item?id=8230690 About Public Key Pinning (72 points by tptacek 43 days ago | 5 comments): https://news.ycombinator.com/item?id=9548602 https://news.ycombinator.com/item?id=9548602 Public Key Pinning Extension for HTTP (70 points by hepha1979 242 days ago | 28 comments): https://news.ycombinator.com/item?id=8520812 https://news.ycombinator.com/item?id=8520812