Hacker News Reader

A lot of advice online, including my own, recommends that once you start enforcing a policy you keep the max-age quite short for a period of time. The report-only mode is helpful in identifying issues but given the nature of what HPKP is and does, jumping straight to a high max-age value when you start enforcing the policy isn't wise.

View on HN

Yeah, we deployed this short max-age just to be safe on the initial deployment. I have a pull request open right now to switch our backup CA and add the intermediate certificate pins (to avoid possible future cross-signing issues) before we start bumping max-age. HPKP requires careful planning and a low max-age is definitely the way to go until you are 100% confident in your policy.

They don't use reporting.

No, but that doesn't impact the operation of enforcing the use of their public keys which is the main purpose. It's definitely preferable to have reporting though.

When we first deployed our policy there was no support for reporting in browsers. I think that Firefox still lacks support and chrome only added support recently (I'd have to double check, or I'm sure Scott knows).

Exactly right. The only browser that will send HPKP reports right now is Chrome and that was very recent.

Reply on news.ycombinator.com