6

The strength of HTTP Public Key Pinning (HPKP) is that the browsers are saving the keys from the HTTP header and can check in the future if the certificate from the website is valid.

I have two questions concerning that because I couldn't find a good answer:

  • Assume, the HTTP header says that the key pin is valid for 60 days (max-age). Where is it saved? When I delete my browser history and cache every day, is HPKP pointless then?
  • Assume, I am on a website that supports HPKP and the HTTP header says that the key pin is valid for 60 days. Now, when I visit the website after a week again and the HTTP header is still the same, then it's valid for 60 days once more, right?
4

Assume, the HTTP header says that the key pin is valid for 60 days (max-age). Where is it saved? When I delete my browser history and cache every day, is HPKP pointless then?

That will depend on the browser. There are usually several "stores" you can clean, but you should contact your browser vendor about how to do this / request a way to clean history and cookies but not key pinnings.

(Note that depending on your goal, it may be dwarfed by pinning. If you just want to avoid being fingerprinted by the company, that pinnings are kept shouldn't be an issue for now¹, but if you want to conceal that you accessed a web site, and a pinning for it is later found in your computer…)

Assume, I am on a website that supports HPKP and the HTTP header says that the key pin is valid for 60 days. Now, when I visit the website after a week again and the HTTP header is still the same, then it's valid for 60 days once more, right?

That's right.

¹ It is possible to abuse it to expose visited sites or even work as a supercookie, though. See the slides for the Sniffly attack at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.