There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users?
A server could send an extra backup key that is never intended to be used as a public key, but instead is a unique identifier for that visitor. The browser will happily store it, and persist it even if browsing history and cookies are flushed. If the key could somehow be recovered from the client (without having to try all possible keys until you find one that validates) it could be used for tracking users.
So my questions are:
- Can this be done?
- Is it in fact used in the wild?
- Is there any way to protect yourself other than turning off HPKP completely?