Ko tenda hembiapoite sa’ivéta oñemba’apokuévo hese hembiapo porãve hag̃ua. Peteĩ jehaipyre nomoĩporãiramo ne apañuái ha eporanduséramo, roguerekohína ore nepytyvõ rekoha ikatútava ndeykeko @FirefoxSupport Twitter-pe ha avei /r/firefox Reddit-pe.

Avatar for Username

Eheka Pytyvõha

Emboyke pytyvõha apovai. Ndorojeruremo’ãi ehenói térã eñe’ẽmondóvo pumbyrýpe ha emoherakuãvo marandu nemba’etéva. Emombe’u tembiapo imarãkuaáva ko “Marandu iñañáva” rupive.

Kuaave

Ko téma oñeñongatúma. Ejapo porandu pyahu eikotevẽramo pytyvõ.

How to disable HSTS in the browser?

  • 2 Mbohovái
  • 6 oguereko ko apañuãi
  • 3 Hecha
  • Mbohovái ipaháva ideato

gintokisakata
gintokisakata
more options

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google.

http://www.radicalresearch.co.uk/lab/hstssupercookies/

Even the specifications of HSTS mention this possibility:

"14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]."

Please add a feature that allows to reset or disable this feature if not already possible.

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google. http://www.radicalresearch.co.uk/lab/hstssupercookies/ Even the specifications of HSTS mention this possibility: "14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]." Please add a feature that allows to reset or disable this feature if not already possible.

Opaite Mbohovái (2)

guigs
guigs
more options

I think Noscript can do this. But cannot guarantee this.

Other historical suggestions:

Set all request headers to include: Strict-Transport-Security: max-age=0;

ideato
ideato
more options

Hello gintokisakata, guigs2

guigs2 is correct, Noscript can do this, as Noscript said from v 2.6.5.9 version (Released March 11, 2013), see: https://addons.mozilla.org/en-us/firefox/addon/noscript/versions/?page=8 (and : https://noscript.net/changelog )

Removed STS support for Gecko >= 4, which provides built-in HSTS, firefox is on Gecko 5.0 (over 4). (also : https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference )

try to install Noscript and tell us ! :-):-)

thank you