5

There is already a large flora of "supercookies" and browser fingerprinting methods out there. I am wondering whether HPKP provides yet another method to track users?

A server could send an extra backup key that is never intended to be used as a public key, but instead is a unique identifier for that visitor. The browser will happily store it, and persist it even if browsing history and cookies are flushed. If the key could somehow be recovered from the client (without having to try all possible keys until you find one that validates) it could be used for tracking users.

So my questions are:

  • Can this be done?
  • Is it in fact used in the wild?
  • Is there any way to protect yourself other than turning off HPKP completely?
  • I think the problem comes from your parenthesis: I don't think it would scale well, since you'd need a unique key pair per visitor... – Matthew Jun 8 '16 at 11:16
4

HPKP could be used for tracking in big scale since it has report URIs:

  1. Send HPKP header with includeSubdomains set and a report-uri with unique random generated parameter.
  2. Embed a hidden image from a subdomain that uses a invalid/not pinned certificate.
  3. Browser calls report-uri with unique parameter.

Only issue I see is a new report-uri with new UID being issued each time the user visits the site that sets the UID.

Also see Privacy Considerations section of the HPKP RFC.

  • 1
    Let's Encrypt certs are free and can be obtained automatically rather quickly, and just because Apache doesn't support a particular use case doesn't mean it's impossible. The real question here is whether the server have a way to check what HPKP keys the browser has pinned. – Ajedi32 Jun 8 '16 at 13:22
  • 1
    "Let's Encrypt certs are free and can be obtained automatically rather quickly" yes, if you don't track more than 100 persons a week. Or you need more than 1 domain. (not subdomains) And even than you'd need 20 subdomains – you Jun 8 '16 at 13:34
  • More than 100 new people per week, yes. After a cert is issued, you could continue using it to track the person it was issued for until it expired. But you make a good point: even with Let's Encrypt this method doesn't scale well. – Ajedi32 Jun 8 '16 at 13:42
  • @Ajedi32 just had an idea how this might be possible. see edit. – you Jun 8 '16 at 13:53
  • 2
    One certificate per user is not necessary. Simply apply some binary encoding and number of certs requried becomes log(users to track). I.e. 10 certs for 10 sub-domains can track 1023 users if you user different combinations of them for each user. – billc.cn Jun 8 '16 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.