Browsers and HTTP Public Key Pinning

Question

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid.

I have two questions concerning that because I couldn't find a good answer:

• Assume, the HTTP header says that the key pin is valid for 60 days (max-age). Where is it saved? When I delete my browser history and cache every day, is HPKP pointless then?
• Assume, I am on a website that supports HPKP and the HTTP header says that the key pin is valid for 60 days. Now, when I visit the website after a week again and the HTTP header is still the same, then it's valid for 60 days once more, right?

Answer 1

Assume, the HTTP header says that the key pin is valid for 60 days (max-age). Where is it saved? When I delete my browser history and cache every day, is HPKP pointless then?

That will depend on the browser. There are usually several "stores" you can clean, but you should contact your browser vendor about how to do this / request a way to clean history and cookies but not key pinnings.

(Note that depending on your goal, it may be dwarfed by pinning. If you just want to avoid being fingerprinted by the company, that pinnings are kept shouldn't be an issue for now¹, but if you want to conceal that you accessed a web site, and a pinning for it is later found in your computer…)

Assume, I am on a website that supports HPKP and the HTTP header says that the key pin is valid for 60 days. Now, when I visit the website after a week again and the HTTP header is still the same, then it's valid for 60 days once more, right?

That's right.

¹ It is possible to abuse it to expose visited sites or even work as a supercookie, though. See the slides for the Sniffly attack at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf