Questions tagged [hpkp]
The hpkp tag has no usage guidance.
20
questions
0
votes
1
answer
118
views
Public Key Pinning Attack? [duplicate]
I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
- 131
2
votes
1
answer
3k
views
Whats the difference between certificate pinning and a truststore in Android/iOS? [duplicate]
I‘m facing the implementation of certificate pinning and often get asked why if there are trust stores within Android, iOS does not have such a concept. So I’m required to build the standard HPKP and ...
- 123
1
vote
2
answers
987
views
Is DANE the DNS-variant of HTTP Public Key Pinning (HPKP)?
I’m trying to understand DANE and TLSA records more accurately. Is it fair to call DANE the DNS-variant of (or at least a very similar technique to) HTTP Public Key Pinning (HPKP)?
Because with HPKP ...
- 6,661
3
votes
1
answer
447
views
can HPKP certificate pinning disable DPI inspection on firewall?
Is it possible that Firefox and Chrome disable pin validation for users who imported custom root certificates all pinning violations are ignored. What is impact of that? Will browser report any ...
- 31
0
votes
1
answer
386
views
Is HPKP a alternative to DNSSEC? [duplicate]
Using the Public Key Pinning header the user will only trust in my SSL Certificate, supposedly.
If I use only the HPKP and the certificate is safe, the attacker not got it, still possible the ...
- 111
6
votes
1
answer
458
views
HPKP for self-signed certificates
On https://dev.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- ,
and https://developer.mozilla.org/en-US/docs/Web/HTTP/...
- 95
4
votes
2
answers
622
views
What are the disadvantages of HPKP?
I have noticed that many web sites do not implement HPKP even though it is simple to implement. Is there any downside to it?
- 51
1
vote
1
answer
3k
views
Is the CSR and public key the exact same thing?
Is the CSR and public key the exact same thing?
I require the CSR - can I create a Public key from .cer and use it as CSR?
I need the CSR for HPKP backup key generation.
Is OpenSSL the only way to ...
- 135
1
vote
0
answers
1k
views
Is it possible to go through proxy while PK Pinning is enabled?
My JavaFX client application and server has PK Pinning enabled. However, some clients ask us to add proxy support to the client app because the direct access in their office is closed and all the ...
2
votes
2
answers
989
views
What is HPKP and how does it work in case of websites
I was looking at HTTP Strict Transport Security (HSTS) implementation in firefox. Firefox stores this data for sites in a file called SiteSecurityServiceState.txt
I see entries in it like -
...
- 1,065
3
votes
0
answers
118
views
What is the maximum amount of certificates that can be pinned with HPKP?
We are currently looking into enabling HTTP Public Key Pinning on our website. The problem we are currently facing is that our certificates last only 90 days, but we have devised the following steps ...
- 1,096
2
votes
1
answer
2k
views
Are there any mechanisms to preload HTTP Public Key Pinning
For HTTP Strict Transport Security (HSTS), there is a preload list, that site owners can submit their site to a list of domain names that the browser vendors ship their browsers with.
Are there any ...
- 734
3
votes
1
answer
182
views
Doesn't HPKP become useless after the max age has expired?
The basic idea behind HPKP was to protect your users from MITM attacks if an intermediate CA accidentally issues fraudulent certificate for your domain to the attacker. ...
anon
3
votes
1
answer
3k
views
What are the columns in Firefox's SiteSecurityServiceState.txt? [closed]
Firefox's SiteSecurityServiceState.txt file (located in the profile folder) records the HSTS times and HPKP expiry times and pins. There are multiple columns, and I don't know what they represent:
An ...
- 1,726
1
vote
2
answers
571
views
Replacing a TLS cert when the old one is pinned (HPKP)
Suppose my Public-Key-Pins max-age is 60 days. When can I deploy a new cert? 60 days from now? But what about browsers who first connect to my site between now and 60 days from now?
This site says:
...
- 1,726
1
vote
1
answer
158
views
Is HPKP enforced on the server or in the client?
I'm trying to learn about HPKP and I am trying to grasp if it is just a level of protection for user agents to mitigate MiTM attacks over HTTPS or if the server also plays a role.
Please keep in ...
- 113
4
votes
3
answers
2k
views
Is SSL Interception possible without disabling Public Key Pinning on the client side?
I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites.
But there are some sites which use HTTP Public Key Pinning to prevent MitM ...
- 4,313
5
votes
1
answer
330
views
Can HPKP be used to track users?
There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users?
A server could send an extra ...
- 65.4k
1
vote
2
answers
573
views
Public Key Pinning and subdomains
Shortly I have intend to install new webserver and I'd like to secure users a little bit more. I already have domain, (virtual) server and everything else that matters when configuring a server. ...
- 113
-1
votes
1
answer
235
views
Tor website HPKP (key pinning) failure
I'm currently facing a key pinning error when trying to access the torproject.org website with Firefox.
Is anyone facing the same problem? Does anyone know if they changed their certificate? If not, ...
- 1,104