Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Do any browsers pin certs by default? I haven't heard of CertPatrol, but alerting when a cert changes well before expiration seems like good default.


Chrome has certain google.com certificates (maybe all of them) pinned.

{accounts, mail, docs}.google.com (at least) have HSTS forced and preloaded in Chrome, but www.google.com does not.


I'd love to see where you found this information. I wasn't able to find it in Chrome's source, but I didn't have the change to do a deep dive.


http://www.imperialviolet.org/2011/05/04/pinning.html

http://blog.chromium.org/2011/06/new-chromium-security-featu...

as well as empirical Chrome behavior.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: