5 ms·

I don't see why you would need to generate CAs on the fly. You could have a few end-points with a certificate signed by common intermediates, but not serving th

I don't see why you would need to generate CAs on the fly. You could have a few end-points with a certificate signed by common intermediates, but not serving the intermediate themselves. Then you can check if resources from those end-points load or not, effectively fingerprinting the user's cache for those common intermediates. I'm not sure how feasible this is, but certainly seems more feasible than generating CAs on the fly.

jeroenhd 4y ago
That's possible but for that you'd need a valid certificate from every intermediate you fingerprint. You can maybe get a few bits out of it, but the moment you fingerprint the device it's got the intermediates practically forever. If the user clears all cookies, storage, etc. and you try to match the device with the old profile it'll still keep the old certs cached and it won't appear the same.
- planede 4y ago
  > the moment you fingerprint the device it's got the intermediates practically forever That's not true, the point is that you fingerprint using misconfigured hosts, they never get the intermediates through them. Of course it's possibly hard to use this practically, but anyway, apparently Firefox deemed it to be concerning enough to eventually fix it according to https://bugzilla.mozilla.org/show_bug.cgi?id=1334485 https://bugzilla.mozilla.org/show_bug.cgi?id=1334485.