Google's certificates are statically pinned in at least Chrome and Firefox. http...

sneak · on Sept 30, 2016

I don't use either of those as http clients in my idiotic hobby projects that lookup DNS over TLS/HTTP.

tinix · on Sept 30, 2016

Those links are incredibly outdated, in internet time.

https://tools.ietf.org/html/rfc7469

https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning

https://bugzilla.mozilla.org/show_bug.cgi?id=787133

https://developer.mozilla.org/en-US/docs/Web/Security/Public...

pauldino · on Sept 30, 2016

Independent of HPKP Chrome still does 2011-style static pinning AFAIK and just by looking at HTTP headers I don't think google.com even uses HPKP. Unlike HPKP which is trust-on-first-use, static pinning is enforced from the very start so if you have the ability to statically pin in the client (as you would if you're a browser vendor or distributing your own mobile app) you probably should.

And then there is this recent discussion: https://news.ycombinator.com/item?id=12434585