Hacker News new | ask | show | jobs
by mgdm 1641 days ago
I don’t believe any modern browser supports HPKP any more, due to how hard it was to set up and operate.
1 comments

They still honor it. I have to tell squid which domains to not MITM because some of Google's sub-domains, paypal, the EFF and a few others still use it.
I suspect all of those pins are from preloading (arranged by request with Chrome maintainers) and not HPKP. HPKP was supposed to allow for similar security after first use, without needing to interact with maintainers and wait for a browser release, but because of the probability of shooting your own foot, usage was extremely low and it was on the path to removal, last I checked.