Sök i support

Akta dig för supportbedrägerier: Vi kommer aldrig att be dig att ringa eller skicka ett sms till ett telefonnummer eller dela personlig information. Rapportera misstänkt aktivitet med alternativet "Rapportera missbruk".

Learn More

How to disable HSTS in the browser?

  • 2 svar
  • 6 har detta problem
  • 8 visningar
  • Senaste svar av ideato

more options

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google.

http://www.radicalresearch.co.uk/lab/hstssupercookies/

Even the specifications of HSTS mention this possibility:

"14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]."

Please add a feature that allows to reset or disable this feature if not already possible.

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google. http://www.radicalresearch.co.uk/lab/hstssupercookies/ Even the specifications of HSTS mention this possibility: "14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]." Please add a feature that allows to reset or disable this feature if not already possible.

Alla svar (2)

more options

I think Noscript can do this. But cannot guarantee this.

Other historical suggestions:

Set all request headers to include: Strict-Transport-Security: max-age=0;

more options

Hello gintokisakata, guigs2

guigs2 is correct, Noscript can do this, as Noscript said from v 2.6.5.9 version (Released March 11, 2013), see: https://addons.mozilla.org/en-us/firefox/addon/noscript/versions/?page=8 (and : https://noscript.net/changelog )

Removed STS support for Gecko >= 4, which provides built-in HSTS, firefox is on Gecko 5.0 (over 4). (also : https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference )

try to install Noscript and tell us ! :-):-)

thank you