6

As I know HSTS is mainly implemented to mitigate famous sslstrip attack in which browser is forced to use ssl when connecting to particular site. And I think it also prevents user to proceed to site if there is a problem with ssl cert which the site provides. Are there anything more to know about HSTS ?

Also I read mostly superficial info about HSTS and that it can be defeated. Is this possible ? (Except the obvious way to intercept before the user connects first time and block hsts header)

Which browsers support hsts ? Can hsts data be cleared like clearing browser history and cookies?

Improve this question
3
  • It depends entirely on the implementation of each browser, how the header is handled and stored. But i would be surprised when clearing the headers would be accessible by a script.
    – martinstoeckli
    Jun 18, 2014 at 8:17
  • Yes, check al Leonardo´s BlackHat ASIAS talk, there he explain an attack to defeat HSTS using a modified version of sslstrip and a dns server.
    – user54449
    Aug 26, 2014 at 0:02
  • I highly recommend this talk by Jose Selvi at Black Hat 2014: youtube.com/watch?v=eLhb4jZuv6M
    – jub0bs
    Mar 4, 2021 at 23:52

1 Answer 1

Reset to default
9

anything more to know about HSTS ?

The two key attacks it mitigates are sslstrip and MITM attacks with self signed certificates (such as the one by the Syrian government against Facebook). It can also help mitigate HTTPS implementation problems that could lead to firesheep style attacks.

it can be defeated. Is this possible ?

As you stated, the major limitation of HSTS is an initial connection over HTTP which makes an sslstrip attack possible. DNSSEC has been proposed as an answer to this, but has not yet been implemented. Given the narrow scope of HSTS, other means of defeating it would probably rely on other attack vectors.

Which browsers support hsts?

At time of writing, Firefox, Chrome, Safari and Opera on desktop, Firefox, Chrome and the default browser on Android, and Opera Mobile. Total 57.84% of global users according to StatCounter.

Source, and for updates: http://caniuse.com/stricttransportsecurity

Can hsts data be cleared like clearing browser history and cookies?

Yes. Here's how to it for Firefox. Like clearing browser history and cookies, this should not be accessible from javascript running on a page (and it would be a major security hole if it were).

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .