News for hackers. Stuff that matters.

A comment on Timing attack against HSTS to sniff browser history in Chrome and Firefox. Parent comment

Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Tuesday October 27, 2015 @01:17AM (#10456429)
I pulled the list of domains out of the Alexa Top 1M plus some domains that my friends run. But I'm not biasing results towards showing up as visited by popularity or anything like that.

I didn't set up analytics to figure out how accurate results are for the average person; having manually checked with a few people's browsers, I'd say the accuracy rate is ~75%.

[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by elangelcentral on Tuesday October 27, 2015 @02:19AM (#10456572)
At a glance, looks about 75% accurate for me. But what really freaked me out is that it correctly flagged a financial institution (not a major one) where I have an account yet feel pretty sure I haven't visited the website in months.
[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Tuesday October 27, 2015 @04:16AM (#10456807)
Yeah, part of the nice/scary thing about HSTS is that it is a highly persistent cache. The browser is reluctant to clear it because it's a security feature. So HSTS pins can be stored for up to a year in FF/Chrome, even if you are deleting cookies regularly.
[ Parent | on HN ]