6

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site if there is a problem with ssl cert which the site provides. Are there anything more to know about HSTS ?

Also I read mostly superficial info about HSTS and that it can be defeated. Is this possible ? (Except the obvious way to intercept before the user connects first time and block hsts header)

Which browsers support hsts ? Can hsts data be cleared like clearing browser history and cookies?

  • It depends entirely on the implementation of each browser, how the header is handled and stored. But i would be surprised when clearing the headers would be accessible by a script. – martinstoeckli Jun 18 '14 at 8:17
  • Yes, check al Leonardo´s BlackHat ASIAS talk, there he explain an attack to defeat HSTS using a modified version of sslstrip and a dns server. – user54449 Aug 26 '14 at 0:02
9

anything more to know about HSTS ?

The two key attacks it mitigates are sslstrip and MITM attacks with self signed certificates (such as the one by the Syrian government against Facebook). It can also help mitigate HTTPS implementation problems that could lead to firesheep style attacks.

it can be defeated. Is this possible ?

As you stated, the major limitation of HSTS is an initial connection over HTTP which makes an sslstrip attack possible. DNSSEC has been proposed as an answer to this, but has not yet been implemented. Given the narrow scope of HSTS, other means of defeating it would probably rely on other attack vectors.

Which browsers support hsts?

At time of writing, Firefox, Chrome, Safari and Opera on desktop, Firefox, Chrome and the default browser on Android, and Opera Mobile. Total 57.84% of global users according to StatCounter.

Source, and for updates: http://caniuse.com/stricttransportsecurity

Can hsts data be cleared like clearing browser history and cookies?

Yes. Here's how to it for Firefox. Like clearing browser history and cookies, this should not be accessible from javascript running on a page (and it would be a major security hole if it were).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.