4 ms·
Show HN: I Implemented a HSTS Super Cookie
- ben174 11y agoI'd been made aware of the possibility of using HSTS redirects to create a fingerprint, but I've yet to see someone make the code available. Please feel free to dig in / contribute / critique.
- mirimir 11y agoNice.
- leesalminen 11y agoWhat's the need for a wildcard cert? Could you use 24 lets encrypt certificates for each sub domain? Genuinely curious.
- ben174 11y agoYea my first thought was that 24 bits should be able to grow to accommodate more fingerprints, so it would make more sense to have a wildcard. But you could definitely have 24 individual certificates. I wasn't aware of Let's Encrypt, I'll look into grabbing 24 certs from there and spinning up a demo. Thanks!
- breakingcups 11y agoAlexanderS makes a good point here: https://github.com/ben174/hsts-cookie/issues/1 https://github.com/ben174/hsts-cookie/issues/1 You can request one certificate with multiple SubjectAltNames from LetsEncrypt, might save you some trouble.
- binwiederhier 11y agoI didn't know about this vulnerability. This just blew my mind. Great work on the PoC!