Timing attack against HSTS to sniff browser history in Chrome and Firefox

Re:Timing attack against HSTS to sniff browser history in Ch... by chrismarlow9 on Monday October 26, 2015 @11:31PM (#10456132)

It's accurate depending on what you're looking for. Saying you didn't visit a site means you either did, or did not, but saying you did visit a site means you 100% did for sure. In the case of a negative the results are meaningless, but in the case of a positive they are accurate. Similar to a bloom filter

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by michaelmior on Monday October 26, 2015 @11:47PM (#10456191)

I saw several sites pop up on the list of sites I visited that I'm quite sure I've never explicitly been to. It's possible these were all loaded via ads or some such thing, but it seems unlikely.

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by lysium on Tuesday October 27, 2015 @01:09AM (#10456408)

I've just checked my history and the sites I thought I have not visited do not show (2/14). Maybe 85%?

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Tuesday October 27, 2015 @01:20AM (#10456432)

Yeah, I think the accuracy so far has been like 75-80% among my friends (once httpseverywhere is disabled). PS: you can check whether sites are in your HSTS cache in chrome at chrome://net-internals#hsts

[ Parent | on HN ]