News for hackers. Stuff that matters.

A comment on Tracking Users Across the Web via TLS Session Resumption. Parent comment

Re:Tracking Users Across the Web via TLS Session Resumption by ickwabe on Friday October 19, 2018 @09:53AM (#18256717)
I dont think this is correct. I added the boolean security.ssl.disable_session_identifiers set to true in Firefox 62.0.3 and ran the SSL Labs browser test here: https://www.ssllabs.com/ssltest/viewMyClient.html. With the boolean set to true, Session Tickts under the Protocol Details section says false. Toggling the setting back to false and rerunning the set showed Session Tickets Yes. So perhaps you had a typo in the seeting name?
[ Parent | on HN ]
Re:Tracking Users Across the Web via TLS Session Resumption by settingsquest on Friday October 19, 2018 @10:25AM (#18256913)
Under Firefox 62.0 (64-bit), setting security.ssl.disable_session_identifiers=true, I also see "Session tickets" change from Yes to No. Thanks!
[ Parent | on HN ]
Re:Tracking Users Across the Web via TLS Session Resumption by Asseon on Sunday October 21, 2018 @10:15AM (#18268045)
you are right, bad case of a Layer 8 issue.
[ Parent | on HN ]