4

TACK is an IETF draft that allows certificate pinning for a TLS web server, provided the clients' browsers support it. Unlike the certificate pinning feature available with HSTS preloading, the server's operator is not committing to a particular certificate in the chain (and hence typically to a particular root or intermediary CA), instead retaining his own (offline) key that can be used to authorize the use of a new server TLS certificate.

Which browsers support TACK? Are there extensions to add support to browsers that do not otherwise support it?

Improve this question
3
  • Tag wishlist: certificate-pinning or TLS-certificate-pinning
    – user27909
    Commented Apr 8, 2014 at 16:53
  • You said it, this is still a draft. No official server support. No official browser support. Almost nobody is taking this seriously, and that's not just me, that's basically what they're saying about their own project. In my personal opinion, this is a dead/dying project.
    – Adi
    Commented Apr 9, 2014 at 5:08
  • That link in itself is a good answer, but not your summary of it. Otherwise: Many drafts get implemented before (if ever) becoming a standard, especially in web servers and web browsers. Just consider HSTS...
    – user27909
    Commented Apr 9, 2014 at 10:16

1 Answer 1

Reset to default
2

Good Question. TACK is a "dynamic pinning" solution to the broken Certificate Authority model we all depend on today. A competitor is Google's Certificate Transparency (CT).

Status of TACK is

  • No browsers currently support it.
  • There are no browser extensions to enable it.
  • The last posting from the developers (January, 2014) is that it is entirely up to the browsers to support it and that we "hope we'll get more progress in 2014".
Improve this answer
1
  • CT has a different purpose. It can't prevent a targeted MITM that is in progress, especially if the CA is complacent or the root certificate is stolen (after all, CT relies on the honesty of a CA).
    – forest
    Commented Aug 18, 2018 at 2:49

You must log in to answer this question.