Avatar for Username

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

This thread was archived. Please ask a new question if you need help.

How to disable HSTS in the browser?

  • 2 replies
  • 6 have this problem
  • 3 views
  • Last reply by ideato

gintokisakata
gintokisakata
more options

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google.

http://www.radicalresearch.co.uk/lab/hstssupercookies/

Even the specifications of HSTS mention this possibility:

"14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]."

Please add a feature that allows to reset or disable this feature if not already possible.

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google. http://www.radicalresearch.co.uk/lab/hstssupercookies/ Even the specifications of HSTS mention this possibility: "14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]." Please add a feature that allows to reset or disable this feature if not already possible.

All Replies (2)

guigs
guigs
more options

I think Noscript can do this. But cannot guarantee this.

Other historical suggestions:

Set all request headers to include: Strict-Transport-Security: max-age=0;

ideato
ideato
more options

Hello gintokisakata, guigs2

guigs2 is correct, Noscript can do this, as Noscript said from v 2.6.5.9 version (Released March 11, 2013), see: https://addons.mozilla.org/en-us/firefox/addon/noscript/versions/?page=8 (and : https://noscript.net/changelog )

Removed STS support for Gecko >= 4, which provides built-in HSTS, firefox is on Gecko 5.0 (over 4). (also : https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference )

try to install Noscript and tell us ! :-):-)

thank you