6

I've read many articles talking about google chrome killing public key pinning in Chrome 67 (May 2018). See here, here, and here.

However, I haven't found any information about whether or not they actually pulled the trigger on their plans. Moreover, in my own efforts I haven't been able to conclusively decide if public key pinning support has been removed from recent versions of Chrome. This page seems to suggest it was removed in Chrome 72, but the linked discussion on that page differentiates between dynamic pinning (which is intended to be removed immediately) and static pinning (which may continue to be supported for a longer and unspecified period of time). It's not clear to me from the status page which "kind" of pinning was removed.

So do recent versions of Chrome ignore public key pinning headers? Have Firefox or Opera followed suit?

  • I won't post an answer because I'm not sure, but based on that page and the linked Chromium issue it does appear to have completely removed. – Fund Monica's Lawsuit Jul 12 '19 at 19:54
  • Most of my confusion is that I was playing around with it in an attempt to answer another question and couldn't seem to get it to work with either Chrome or Firefox. That might be a sign that it is completely removed, but I've also never used it before so I could have easily been doing it wrong. Further, I found much more recent documentation from the GCP documenting how to get public key pinning headers on for their platform, which seemed confusing (although not a clear sign either way)... – Conor Mancone Jul 12 '19 at 19:59
  • @NicHartley Moreover, in my testing I didn't see any warnings in the console about public key pinning being unsupported, although one of the topics of discussion on that page is implementing such warnings... Basically, I'm just completely unsure! – Conor Mancone Jul 12 '19 at 20:00
  • Having experimented with custom HTTP headers, I don't think I've ever seen any warnings about unrecognized headers -- it's possible Chrome sees the HPKP header and just assumes it's some custom thing, and ignores it silently. That said, I'm just speculating, and after reading some more of the discussion on the Chromium bug, it appears certain types of HPKP may still be supported, just not all of them. – Fund Monica's Lawsuit Jul 12 '19 at 20:04
  • 2
    @NicHartley I think the trouble is that, having now played around with it, it's actually quite a pain to test. I was testing it with self-signed certificates on my local machine, having imported the root certificate into my browser store. However upon further reading I found evidence that google might completely ignore certificate pinning except with root certificates that shipped with its original certificate store. That suggests the only way to test it is with servers hosted on actual domains, and while I could get a cert for one (let's encrypt), testing it becomes much more of a pain... – Conor Mancone Jul 12 '19 at 20:10
4
+200

HPKP was planned to be removed in Chrome 65, then in 67 and actually deprecated in v 69.

It no longer exists in Chrome 72 and shows as removed, just as you found also.

TLS 1 and 1.1 are also deprecated in v72.

Firefox has a debate about it here.

Opera version 25 to 53 support Public Key Pinning.

  • One thing I can't quite figure out is if the entire feature was removed, or if only part of it was. In particular, the page about its removal links to a discussion: groups.google.com/a/chromium.org/forum/#!msg/blink-dev/… that mentions removing support for dynamic pins but leaving in support for static pins for some longer but unspecified period. I'm actually not clear on what the difference is, nor is it clear if only dynamic pins were removed or if the whole feature was scrapped. – Conor Mancone Jul 17 '19 at 17:25
  • 1
    After some more research I think I answered my own question. Static pinning is when the public keys ship with the browser. Dynamic pinning is when the site sends down a public key pinning header with the HTTPS response. Since the chrome status page mentions removing "HTTP-Based Public Key Pinning" I'm guessing it is only the dynamic pinning that has been removed (which happens to be the only one that is easily accessible to site administrators). – Conor Mancone Jul 17 '19 at 17:31
2

From the Chrome 72 article on Chromium blog:

Remove HTTP-Based Public Key Pinning

HTTP-Based Public Key Pinning (HPKP) was intended to allow websites to send an HTTP header that pins one or more of the public keys present in the site's certificate chain. Unfortunately, it has very low adoption, and although it provides security against certificate mis-issuance, it also creates risks of denial of service and hostile pinning. For these reasons, this feature is being removed.

HPKP was indeed removed in Chrome 72.

  • One thing I can't quite figure out is if the entire feature was removed, or if only part of it was. In particular, the page about its removal links to a discussion: groups.google.com/a/chromium.org/forum/#!msg/blink-dev/… that mentions removing support for dynamic pins but leaving in support for static pins for some longer but unspecified period. I'm actually not clear on what the difference is, nor is it clear if only dynamic pins were removed or if the whole feature was scrapped. – Conor Mancone Jul 17 '19 at 17:25
  • @ConorMancone HPKP was removed but PKP is stil present! You can check your preconfigured public keys here: chrome://net-internals/#hsts – Benoit Esnard Jul 17 '19 at 22:59
  • @ConorMancone If PKP were fully removed, Chrome wouldn't be able to detect a pinning error on pinning-test.badssl.com – Benoit Esnard Jul 17 '19 at 23:00
  • Removing a feature does not mandatory implies removing all it's components. – Overmind Jul 18 '19 at 11:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.