Timing attack against HSTS to sniff browser history in Chrome and Firefox

Re:Timing attack against HSTS to sniff browser history in Ch... by yeukhon on Monday October 26, 2015 @11:05PM (#10456038)

So what does it mean if now UA vendors have 1 million hosts added to HSTS pre-load list? Are they all created equal? Do they share the same preload list? Is there a single form to submit to all UA vendors? What if you have internal hosts that you still want the same mitigation in place? What is UA vendors' SLA on updating preload list? Preload suffers the same problem as pinning, correct me if I am wrong.

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by ejcx on Monday October 26, 2015 @11:22PM (#10456109)

Preload does not suffer the same issue as pinning using a header. All sites on the list would just look like you probably visited them, which means ambiguity.

Not all UAs share the same preload list, but they all borrow from the chrome preload list. Read here https://hstspreload.appspot.com/.

Its not a great ecosystem and I dont forsee it as one that is improving, with encryption being a big issue in some countries

[ Parent | on HN ]