3 ms·
Here is an interesting dilemma: should HSTS persist in incognito mode? If not, then this becomes bad advice, because all the attacker has to do to disable HTTP
by bonyt 9y ago
Here is an interesting dilemma: should HSTS persist in incognito mode?
If not, then this becomes bad advice, because all the attacker has to do to disable HTTPS is not redirect http sites to https ones (sslstrip).
If so, then the list of sites for which your browser attempts HTTPS connections without being told to is the list of sites you’ve accessed in the past. This information could become a supercookie allowing sites to identify and track you even in incognito mode.
https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-browser-dilemma-how-hsts-supercookies-make-you-choose-between-privacy-or-security/ https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...
- Klathmon 9y agoUnless the website makes use of HSTS preload
- varenc 9y agoThis is possible! HSTS does apply to incognito to my knowledge Here’s a project that uses this fact to look up browser history: https://github.com/diracdeltas/sniffly https://github.com/diracdeltas/sniffly
- crunchatized 9y agoAt least it only works on chromium-based browsers. Firefox fixed the supercookie problem when opening up a private browsing session back in Firefox 34.0.5 after it was discovered. Which then makes the HSTS preload list and HTTPS Everywhere extension all the more valuable to defend against active attacks.