Firefox stores HSTS data in a file named SiteSecurityServiceState.txt
.
This poses two serious issues:
It creates an opportunity for tracking. See http://www.radicalresearch.co.uk/lab/hstssupercookies
It creates a privacy issue by leaving behind a plain text list of many of the secure sites the user visited, even after they have cleared the browser's cache and history.
Because of these issues, many people have chosen to create a dummy SiteSecurityServiceState.txt
file by creating a zero-byte file with that name, and marking it as read-only.
This technique prevents Firefox from writing anything to SiteSecurityServiceState.txt
.
Obviously, this prevents the inter-session benefits of HSTS (meaning one Firefox session benefiting the next session), since no data persists. But does this technique prevent the intra-session benefits of HSTS (meaning the benefits within a single Firefox session)?
As an aside, other major browsers suffer from these same issues. But to keep answers focused, this question only deals with the Firefox browser.