yan
nice demo of a thing we've been afraid of for a while: using HSTS to track incognito users. http://www.radicalresearch.co.uk/lab/hstssupercookies … via @garrettr_ @thorsheim
-
-
- View other replies
-
@fugueish@garrettr_@thorsheim have you studied what % of users have the right intuition for what incog mode does? -
@bcrypt@garrettr_@thorsheim We're looking into it. Anecdata is... sad cc@__apf__
-
-
@bcrypt looks like@whitehatsec Aviator wipes the values by default between browser sessions.@garrettr_@thorsheim -
@bcrypt@garrettr_@thorsheim Firefox has some protections against that - private/non-private contexts are separate wrt hsts -
@bcrypt Safly his also underlines that Safari is actively hostile and the most insecure (major) browser. :(@garrettr_@thorsheim@thegrugq -
@bcrypt@matthew_d_green@garrettr_@thorsheim it does not seem to work in Firefox for android, yay :-) -
@bcrypt@Skhaen@garrettr_@thorsheim well, this is a bad usage of HSTS.@firefox doesn't track with that for example, Safari does.
Chris Palmer
Kenn White
David Keeler
MacLemon
Guillaume
Matlink
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.