Timing attack against HSTS to sniff browser history in Chrome and Firefox

Re:Timing attack against HSTS to sniff browser history in Ch... by peteretep on Monday October 26, 2015 @11:17PM (#10456093)

Having disabled NoScript, Privacy Badger, HTTPS Everywhere, and AdBlock Pro, it can tell I've been to npmjs.com. I'm not immediately worried.

Maybe too obvious to point out, but as far as I can tell, it looks for entries in the browser cache, rather than looking at the history per-se. If you have the browser cache empty when you close the browser (gotta watch those evercookies!), that's also not an issue.

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Monday October 26, 2015 @11:30PM (#10456127)

sort of. the hsts cache gets cleared when a private browsing session is closed or when you clear it manually in browser settings. it takes a long time (up to a year) to expire on its own.

[ Parent | on HN ]