There's a nice survey paper from 2012 that lists dozens of supercookie vectors, including HSTS. https://cyberlaw.stanford.edu/files/publication/files/trackings

There's a nice survey paper from 2012 that lists dozens of supercookie vectors, including HSTS. https://cyberlaw.stanford.edu/files/publication/files/trackingsurvey12.pdf https://cyberlaw.stanford.edu/files/publication/files/tracki... FTA: "A website can encode a globally unique pseudonymous device identifier into any stateful web technology so long as it persists at least log2 n bits, where n is the number of Internet-connected devices (presently roughly 5 billion, requiring 33 bits)."