DEV Community

Discussion on: Cryptoheist!

Collapse
 
imsop profile image
Rowan Collins

Regarding HPKP, I believe the reason it's being abandoned is that if you don't use it, an attacker can use it against you: they can pin their bogus certificate with a long lifetime, and after taking back control, you find that your users no longer trust any certificate you serve. Add in the fact that people are bad at keeping private keys safe (what if you lose the key? What if the key is stolen and you forgot to pin an alternative?) and it was deemed to be a nice idea but a dead end. CT doesn't replace it exactly, but it's a newer idea in the same problem-space.

Collapse
 
dwd profile image
Dave Cridland

That's possible. I'd note it's only Google doing this switch, though.

The problem with CT is that it only limits the window; this attack was just two hours anyway. I don't buy that CT would help much in this instance.