Timing attack against HSTS to sniff browser history in Chrome and Firefox

Re:Timing attack against HSTS to sniff browser history in Ch... by e12e on Tuesday October 27, 2015 @07:02AM (#10457285)

> Mitigation, get your site added to the HSTS Preload list.

If that could scale, we wouldn't need DNS?

Come to think of it, as ip addresses aren't distributed, why not have HSTS be a flag in DNS, rather than a header? (Yeah, I know, because DNS isn't secure - but that's the real problem, right there...).

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by AndyMcConachie on Tuesday October 27, 2015 @08:25AM (#10457528)

Or, if the site you're visiting is DNSSEC enabled, you could just look for a TLSA record. If the TLSA record is present, don't allow unencrypted connectivity.

That's probably how you could replace HSTS with DNS.

[ Parent | on HN ]

Re:Timing attack against HSTS to sniff browser history in Ch... by cbsmith on Tuesday October 27, 2015 @01:36PM (#10459678)

Even without DNSsec, HSTS could pretty much work as advertised.

[ Parent | on HN ]