10Leaf certificate, public key, intermediate or root: what should a client pin, and why did HTTP Public Key Pinning fail on the web?▼hardNewGoogleAppleMicrosoft○ sign inPinning trades availability for a narrower trust set. The answer that scores compares each pin target by what it survives, and uses HPKP's retirement as evidence of what goes wrong.Open full answer →
10Should a mobile app pin certificates? If so, what do you pin, and how do you rotate keys without breaking the fleet?▼hardNewAppleGoogleJPMorgan Chase○ sign inPinning narrows trust, and every outage story about it is a rotation story. The scored answer decides whether to pin at all, pins public keys with backups, and plans for the release that can never update.Open full answer →