Hacker News Reader

Comment by kentonv | Hacker News Reader

Honestly HPKP terrifies me. If you key is lost or compromised, you "brick" your site. How do you recover from the next Heartbleed?

I think it could make sense to pin an offline key which is in turn used to sign online keys -- it's at least somewhat feasible to build secure, reliable storage for offline keys. But with current tech that would require that your offline key is a CA key, and as a regular user you have no ability to obtain such a certificate.

So basically I don't think HPKP is a good idea, unless you are Google.

I think certificate transparency is the most promising way forward here.

View on HN

You can prepare the spare certificate in advance: generate two private keys (preferably with different software on different machines), buy two certs, and only put one of them online. That way, if something goes wrong, you have a known-working certificate you can switch to. It doubles the cost, which may or may not be worth the money.

You're also allowed to pin any certificate in the chain, not just the end-entity cert (https://tools.ietf.org/html/rfc7469#section-2.6), so you have some other options. You can pin some number of CAs that you think are trustworthy CAs: pin not only GlobalSign but a few other major CAs that you'd consider using in the future. That doesn't protect you from all the things HPKP could possibly protect you from, but it does protect you from the DigiNotars and MCS Holdings and TURKTRUSTs of the world.

You don't need to buy a spare cert in advance. You can use a a CSR, and only get it signed when necessary.

It's true you can really DOS your own site if you don't follow best practices or have catastrophic data loss. Same with HSTS if you ever need to go back to HTTP.

On balance, yours is a solid decision for your company and for typical users. Just pointing out a complication with something new people are starting to use.

I've just started using it with a short TTL and several extra hashes I can fall back on in reserve. Works fine but I'm definitely not 'all in' yet.

Edit: Also, if my understanding is correct you _do_ create an offline 'key' to generate hashes with a backup CSR, though this won't help if your machine (with the backup CSR used to generate a new key & recover from a server compromise) is also compromised.

An offline signing key was proposed as TACK: http://tack.io

Unfortunately HPKP was adopted by the browsers and TACK has gotten no traction with the vendors, despite being a more flexible system.

Reply on news.ycombinator.com