Avatar for Username

Támogatás keresése

Kerülje el a támogatási csalásokat. Sosem kérjük arra, hogy hívjon fel egy telefonszámot vagy osszon meg személyes információkat. Jelentse a gyanús tevékenységeket a „Visszaélés bejelentése” lehetőséggel.

További tudnivalók

A témacsoportot lezárták és archiválták. Tegyen fel új kérdést, ha segítségre van szüksége.

How to disable HSTS in the browser?

  • 2 válasz
  • 6 embernek van ilyen problémája
  • 3 megtekintés
  • Utolsó üzenet ettől: ideato

gintokisakata
gintokisakata
more options

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google.

http://www.radicalresearch.co.uk/lab/hstssupercookies/

Even the specifications of HSTS mention this possibility:

"14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]."

Please add a feature that allows to reset or disable this feature if not already possible.

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google. http://www.radicalresearch.co.uk/lab/hstssupercookies/ Even the specifications of HSTS mention this possibility: "14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]." Please add a feature that allows to reset or disable this feature if not already possible.

Összes válasz (2)

guigs
guigs
more options

I think Noscript can do this. But cannot guarantee this.

Other historical suggestions:

Set all request headers to include: Strict-Transport-Security: max-age=0;

ideato
ideato
more options

Hello gintokisakata, guigs2

guigs2 is correct, Noscript can do this, as Noscript said from v 2.6.5.9 version (Released March 11, 2013), see: https://addons.mozilla.org/en-us/firefox/addon/noscript/versions/?page=8 (and : https://noscript.net/changelog )

Removed STS support for Gecko >= 4, which provides built-in HSTS, firefox is on Gecko 5.0 (over 4). (also : https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference )

try to install Noscript and tell us ! :-):-)

thank you