Re:Protecting Against HSTS Abuse
by bcaa7f3a8bbc on Saturday March 17, 2018 @05:13AM
(#16606136)
I remembered a demo showing HSTS's potential tracking capabilities, and it doesn't work well if HTTPS Everywhere is enabled.
On a related note, would strict mode thwart HSTS-based cookies?
My current understanding of this technique is that it depends on the victim being able to connect to HTTP. Since strict mode prevents the victim from making normal HTTP connections, I'm inclined to believe that strict mode does help mitigate this kind of tracking.