3 ms·

Firefox stores HSTS entries in a SQLite database, which you can query by running: echo "SELECT * FROM moz_hosts WHERE type='sts/use';" | sqlite3 permissions.

by agwa 12y ago

Firefox stores HSTS entries in a SQLite database, which you can query by running: echo "SELECT * FROM moz_hosts WHERE type='sts/use';" | sqlite3 permissions.sqlite from inside your profile directory. To clear HSTS entries (which the "Clear recent history" UI does not delete), you can do: echo "DELETE FROM moz_hosts WHERE type='sts/use';" | sqlite3 permissions.sqlite I've been periodically monitoring this database for HSTS supercookies over the last couple years and have yet to see any in the wild.

UhUhUhUh 12y ago
Helpful. Thanks.
WireWrap 12y ago
They were recently moved to the SiteSecurityServiceState.txt file: https://bugzilla.mozilla.org/show_bug.cgi?id=775370 https://bugzilla.mozilla.org/show_bug.cgi?id=775370
- agwa 12y ago
  Good grief. They've replaced a SQLite database with a text file that's loaded into an in-memory hash table because "adoption of HSTS is not very widespread yet" so "using any kind of off-the-shelf database to store this would be inefficient and overly complex." This required a patch that took over a year to review, during which time issues were raised with the text file parser they had to write from scratch. Loading the whole table into memory has clear DoS implications, so they're limiting the table to 1024 entries (making the use of a hash table rather silly), with an eviction strategy[1] that is going to favor older entries and effectively prevent newer entries from being added. [1] https://hg.mozilla.org/releases/mozilla-aurora/rev/b339d53f95f2#l1.421 https://hg.mozilla.org/releases/mozilla-aurora/rev/b339d53f9...
frenchpress 12y ago
Ran the above query on my Fx 34.0.5 profile, which is set to clear all history, cookies, cache, etc. on close of each session. Among the entries was one named track.nextuser.com "About NextUser: We believe every user should have an experience personalized for them..." That doesn't sound very promising.
- agwa 12y ago
  > Among the entries was one named track.nextuser.com In order to be a supercookie they need more than one entry (since each entry only stores 1 bit of information). Do you see any other entries that look like they could be associated with this one?

by agwa 12y ago

UhUhUhUh 12y ago

Helpful. Thanks.

WireWrap 12y ago

They were recently moved to the SiteSecurityServiceState.txt file: https://bugzilla.mozilla.org/show_bug.cgi?id=775370 https://bugzilla.mozilla.org/show_bug.cgi?id=775370

agwa 12y ago
Good grief. They've replaced a SQLite database with a text file that's loaded into an in-memory hash table because "adoption of HSTS is not very widespread yet" so "using any kind of off-the-shelf database to store this would be inefficient and overly complex." This required a patch that took over a year to review, during which time issues were raised with the text file parser they had to write from scratch. Loading the whole table into memory has clear DoS implications, so they're limiting the table to 1024 entries (making the use of a hash table rather silly), with an eviction strategy[1] that is going to favor older entries and effectively prevent newer entries from being added. [1] https://hg.mozilla.org/releases/mozilla-aurora/rev/b339d53f95f2#l1.421 https://hg.mozilla.org/releases/mozilla-aurora/rev/b339d53f9...

frenchpress 12y ago

Ran the above query on my Fx 34.0.5 profile, which is set to clear all history, cookies, cache, etc. on close of each session. Among the entries was one named track.nextuser.com "About NextUser: We believe every user should have an experience personalized for them..." That doesn't sound very promising.

agwa 12y ago
> Among the entries was one named track.nextuser.com In order to be a supercookie they need more than one entry (since each entry only stores 1 bit of information). Do you see any other entries that look like they could be associated with this one?