TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' browsers support it. Unlike the certificate pinning feature available with HSTS preloading, the server's operator is not committing to a particular certificate in the chain (and hence typically to a particular root or intermediary CA), instead retaining his own (offline) key that can be used to authorize the use of a new server TLS certificate.

Which browsers support TACK? Are there extensions to add support to browsers that do not otherwise support it?

  • Tag wishlist: certificate-pinning or TLS-certificate-pinning – pyramids Apr 8 '14 at 16:53
  • You said it, this is still a draft. No official server support. No official browser support. Almost nobody is taking this seriously, and that's not just me, that's basically what they're saying about their own project. In my personal opinion, this is a dead/dying project. – Adi Apr 9 '14 at 5:08
  • That link in itself is a good answer, but not your summary of it. Otherwise: Many drafts get implemented before (if ever) becoming a standard, especially in web servers and web browsers. Just consider HSTS... – pyramids Apr 9 '14 at 10:16

Good Question. TACK is a "dynamic pinning" solution to the broken Certificate Authority model we all depend on today. A competitor is Google's Certificate Transparency (CT).

Status of TACK is

  • No browsers currently support it.
  • There are no browser extensions to enable it.
  • The last posting from the developers (January, 2014) is that it is entirely up to the browsers to support it and that we "hope we'll get more progress in 2014".
  • CT has a different purpose. It can't prevent a targeted MITM that is in progress, especially if the CA is complacent or the root certificate is stolen (after all, CT relies on the honesty of a CA). – forest Aug 18 '18 at 2:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.