Questions tagged [hpkp]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

Is there an alternative to HPKP for dyndns?

For dyndns it's fairly easy to replace the machine behind a domain name: either if the subscription runs out or if the IP changes and the dyndns service hasn't been updated. In that case one can ...
2
votes
1answer
2k views

Whats the difference between certificate pinning and a truststore in Android/iOS? [duplicate]

I‘m facing the implementation of certificate pinning and often get asked why if there are trust stores within Android, iOS does not have such a concept. So I’m required to build the standard HPKP and ...
0
votes
2answers
298 views

Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?

I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)? Because with HPKP ...
3
votes
1answer
333 views

can HPKP certificate pinning disable DPI inspection on firewall?

Is it possible that Firefox and Chrome disable pin validation for users who imported custom root certificates all pinning violations are ignored. What is impact of that? Will browser report any ...
0
votes
1answer
267 views

Is HPKP a alternative to DNSSEC? [duplicate]

Using the Public Key Pinning header the user will only trust in my SSL Certificate, supposedly. If I use only the HPKP and the certificate is safe, the attacker not got it, still possible the ...
6
votes
1answer
326 views

HPKP for self-signed certificates

On https://dev.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- , and https://developer.mozilla.org/en-US/docs/Web/HTTP/...
4
votes
2answers
517 views

What are the disadvantages of HPKP?

I have noticed that many web sites do not implement HPKP even though it is simple to implement. Is there any downside to it?
0
votes
1answer
447 views

Is the CSR and public key the exact same thing?

Is the CSR and public key the exact same thing? I require the CSR - can I create a Public key from .cer and use it as CSR? I need the CSR for HPKP backup key generation. Is OpenSSL the only way to ...
1
vote
0answers
596 views

Is it possible to go through proxy while PK Pinning is enabled?

My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
2
votes
2answers
580 views

What is HPKP and how does it work in case of websites

I was looking at HTTP Strict Transport Security (HSTS) implementation in firefox. Firefox stores this data for sites in a file called SiteSecurityServiceState.txt I see entries in it like - ...
3
votes
0answers
75 views

What is the maximum amount of certificates that can be pinned with HPKP?

We are currently looking into enabling HTTP Public Key Pinning on our website. The problem we are currently facing is that our certificates last only 90 days, but we have devised the following steps ...
2
votes
1answer
2k views

Are there any mechanisms to preload HTTP Public Key Pinning

For HTTP Strict Transport Security (HSTS), there is a preload list, that site owners can submit their site to a list of domain names that the browser vendors ship their browsers with. Are there any ...
3
votes
1answer
125 views

Doesn't HPKP become useless after the max age has expired?

The basic idea behind HPKP was to protect your users from MITM attacks if an intermediate CA accidentally issues fraudulent certificate for your domain to the attacker. ...
3
votes
1answer
2k views

What are the columns in Firefox's SiteSecurityServiceState.txt? [closed]

Firefox's SiteSecurityServiceState.txt file (located in the profile folder) records the HSTS times and HPKP expiry times and pins. There are multiple columns, and I don't know what they represent: An ...
1
vote
2answers
461 views

Replacing a TLS cert when the old one is pinned (HPKP)

Suppose my Public-Key-Pins max-age is 60 days. When can I deploy a new cert? 60 days from now? But what about browsers who first connect to my site between now and 60 days from now? This site says: ...
1
vote
1answer
104 views

Is HPKP enforced on the server or in the client?

I'm trying to learn about HPKP and I am trying to grasp if it is just a level of protection for user agents to mitigate MiTM attacks over HTTPS or if the server also plays a role. Please keep in ...
4
votes
3answers
2k views

Is SSL Interception possible without disabling Public Key Pinning on the client side?

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites. But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
5
votes
1answer
260 views

Can HPKP be used to track users?

There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users? A server could send an extra ...
1
vote
2answers
414 views

Public Key Pinning and subdomains

Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
-1
votes
1answer
189 views

Tor website HPKP (key pinning) failure

I'm currently facing a key pinning error when trying to access the torproject.org website with Firefox. Is anyone facing the same problem? Does anyone know if they changed their certificate? If not, ...