Is HTTP Public Key Pinning Dead? | Qualys

Summary: Qualys researcher Ivan Ristić argues that HTTP Public Key Pinning (HPKP, RFC 7469) is too difficult and too dangerous to use, citing Scott Helme's August 2016 finding of only 375 sites with HPKP deployed and 76 in report-only mode, against roughly 30,000 HSTS instances in the same data set. The core problem is the memory effect: pins remain valid for a period, so losing control of the pinned keys can brick a site, and an attacker who breaks into a server can silently activate HPKP and later remove the keys to take the site down or demand ransom, a technique discussed at DEFCON as RansomPKP.
What you should know: An attacker who gains server access can weaponize HPKP against you without detection, and the RFC's soft recommendation to cap max-age at 60 days still leaves a window in which your own site can be locked out from under you.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026