We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

Ky sajt do të funksionojë me kufizime, teksa bëjmë mirëmbajtjen e tij për të përmirësuar punën tuaj. Nëse një artikull nuk e zgjidh problemin tuaj dhe dëshironi të bëni një pyetje, kemi bashkësinë tonë të asistencës, e gatshme për t’ju ndihmuar, te @FirefoxSupport në Twitter dhe/r/firefox në Reddit.

Avatar for Username

Kërkoni te Asistenca

Shmangni karremëzime gjoja asistence. S’do t’ju kërkojmë kurrë të bëni një thirrje apo të dërgoni tekst te një numër telefoni, apo të na jepni të dhëna personale. Ju lutemi, raportoni veprimtari të dyshimtë duke përdorur mundësinë “Raportoni Abuzim”.

Mësoni Më Tepër

Kjo rrjedhë është arkivuar. Ju lutemi, bëni një pyetje të re, nëse keni nevojë për ndihmë.

How to disable HSTS in the browser?

  • 2 përgjigje
  • 6 e kanë hasur këtë problem
  • 1 parje
  • Përgjigjja më e re nga ideato

gintokisakata
gintokisakata
more options

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google.

http://www.radicalresearch.co.uk/lab/hstssupercookies/

Even the specifications of HSTS mention this possibility:

"14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]."

Please add a feature that allows to reset or disable this feature if not already possible.

After Sam Greenhalgh proved that it is possible to create a unique tracking ID that can be done even if the cache and cookies are deleted manually I would like to know how to disable this feature in my browser. I could not find anything in the about:config or using Google. http://www.radicalresearch.co.uk/lab/hstssupercookies/ Even the specifications of HSTS mention this possibility: "14.9. Creative Manipulation of HSTS Policy Store Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains). Such a technique could potentially be abused as yet another form of "web tracking" [WebTracking]." Please add a feature that allows to reset or disable this feature if not already possible.

Krejt Përgjigjet (2)

guigs
guigs
more options

I think Noscript can do this. But cannot guarantee this.

Other historical suggestions:

Set all request headers to include: Strict-Transport-Security: max-age=0;

ideato
ideato
more options

Hello gintokisakata, guigs2

guigs2 is correct, Noscript can do this, as Noscript said from v 2.6.5.9 version (Released March 11, 2013), see: https://addons.mozilla.org/en-us/firefox/addon/noscript/versions/?page=8 (and : https://noscript.net/changelog )

Removed STS support for Gecko >= 4, which provides built-in HSTS, firefox is on Gecko 5.0 (over 4). (also : https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference )

try to install Noscript and tell us ! :-):-)

thank you