News for hackers. Stuff that matters.

A comment on Timing attack against HSTS to sniff browser history in Chrome and Firefox. Parent comment

Re:Timing attack against HSTS to sniff browser history in Ch... by elangelcentral on Tuesday October 27, 2015 @02:19AM (#10456572)
At a glance, looks about 75% accurate for me. But what really freaked me out is that it correctly flagged a financial institution (not a major one) where I have an account yet feel pretty sure I haven't visited the website in months.
[ Parent | on HN ]
Re:Timing attack against HSTS to sniff browser history in Ch... by bcrypt on Tuesday October 27, 2015 @04:16AM (#10456807)
Yeah, part of the nice/scary thing about HSTS is that it is a highly persistent cache. The browser is reluctant to clear it because it's a security feature. So HSTS pins can be stored for up to a year in FF/Chrome, even if you are deleting cookies regularly.
[ Parent | on HN ]