Hello, welcome to the Tuesday, October 31st, 2017 edition of the Sands and its Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Stockholm, Germany. Let's start with a couple of HVPS-related topics. Now, first of all, Google announced that they may drop support for public key pinning in Google Chrome.

Public key pinning has been around for a couple years now, I believe, but hasn't really taken off for a number of reasons.

First of all, it's not quite straightforward to actually enable it.

And secondly, there is a pretty real denial of service possibility if you are enabling it,

or worse, if an attacker is enabling it for you. Now, just as a quick reminder with public key pinning, your web server will return a special header.

This header will contain hashes for all keys that are valid for your particular host name or domain.

Now, the problem, of course, comes up if you ever need to rotate your key.

Now, public key pinning, the standard actually requires that you have at least two keys listed

here, but if you don't do it right, if you rotate keys and you make a key life that's not in the

list, then, of course, people will no longer be able to connect to your site.

Now, of course, the problem that public keypinning tries to address is very real in that it does prevent someone from going to a certificate authority,

tricking or coercing that certificate authority

in giving them a valid key for your domain.

Now, what Google says is, well, there are actually other ways that don't have all the negative

side effects to accomplish the same thing.

One thing, well, a certificate transparency.

If browsers will only trust certain authorities that do publish certificate transparency lists,

then of course such a bad certificate would be spotted by the legitimate owner of that domain. Of course,

that assumes that domain owners care enough to subscribe to these type of alerts. It's typically

free. It's not at hard to subscribe to the alert. And what it really comes down in the end is that public key pinning

really hasn't taken off. There are only few sites that use it. So probably chances are that

more people will use the certificate transparency alerts and maybe other methods like these CAA DNS records that were

...