648186 - HSTS can be used as a tracking mechanism analogous to cookies

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

See http://haxsys.net/2011/04/the-double-edged-sword-of-hsts-persistence-and-privacy/

Comment 1

[Sid Stamm [:geekboy or :sstamm]]

This was something we considered when implementing HSTS, but the security gain from its use outweighs the privacy encroachment (especially since sites can simply use cookies or your disk/image cache).

We implemented proper private browsing mode support (bug 557598: HSTS data accumulated in private mode will be erased when exiting private mode) to mitigate local-adversary concerns. 

Perhaps it would be worth exploring the addition of an about:config pref to disable HSTS for the ten people who want to disable this feature?

Comment 2

[Georg Koppen]

Updated the original URL as it is outdated. See: http://www.radicalresearch.co.uk/lab/hstssupercookies/ for a new PoC site. What about the idea of binding the wildcard feature to the includeSubdomains flag mentioned in the original blog post? Not worth the effort in the face of initiatives to get certificates easier and cheaper?

Comment 3

[»Q«]

(In reply to Sid Stamm [:geekboy or :sstamm] from comment #1)
 
> Perhaps it would be worth exploring the addition of an about:config pref to
> disable HSTS for the ten people who want to disable this feature?

http://www.ghacks.net/2015/10/16/how-to-prevent-hsts-tracking-in-firefox/ is now drawing additional attention to the issue, so I think there will be more than ten.

Comment 5

[rugk]

WebKit implemented some mitigation to prevent that tracking: https://webkit.org/blog/8146/protecting-against-hsts-abuse/

Maybe you can consider implementing something similar...

Comment 6

[Ben Kelly [:bkelly, not reviewing]]

Note, the webkit blog post in comment 5 mentions they took steps because they say active tracking via this vector in the wild.

Comment 7

[Thorin [:thorin]]

see Bug 1447011

Comment 8

[Valentin Gosu [:valentin] (he/him)]

I think bug 1635828 might have fixed this one?

Comment 9

[Daniel Veditz [:dveditz]]

agreed