6

A few questions :

  • What are HSTS super cookie?
  • How do they work?
  • Why is possible to access them from multiple domains?
  • Do I have to worry and if yes, how to mitigate their effect?

Sources

http://www.radicalresearch.co.uk/lab/hstssupercookies
http://arstechnica.com/security/2015/01/browsing-in-privacy-mode-super-cookies-can-track-you-anyway/

Improve this question
4
  • HSTS has nothing to do with cookies. Do you have a source?
    – rook
    Jan 19, 2015 at 15:08
  • @Rook Added the sources
    – Gudradain
    Jan 19, 2015 at 15:12
  • Is your question not answered in the Ars Technica article?
    – Bob Brown
    Jan 19, 2015 at 15:15
  • Mostly yes but isn't it true that for 99% of the questions that are posted here the solution is already on google? Anyway, this site is often great to produce understandable answer that provide a lot of details.
    – Gudradain
    Jan 19, 2015 at 15:23

1 Answer 1

Reset to default
12

Basically, HSTS allows a site to store a flag (true or false) - in other Words a bit, in a web browser.

Storing HSTS super cookies are accomplished in this way: Lets say we want to store the value A, binary 01000001. We can then store this as by redirecting the user to a series of websites, like https://00.example.org indicating HSTS=off redirecting to: https://01.example.org indicating HSTS=on redirecting to: https://02.example.org indicating HSTS=off ... ... redirecting to: https://08.example.org indicating HSTS=on

"Reading" the cookie is simple as redirecting user to: http://00.example.org If HSTS is on, the webserver will receive a request to https://00.example.org, else http://00.example.org redirect then to http://01.example.org and so on.

The misdesign in HSTS is that the browser should "correct" a HTTP visit to HTTPS automatically if HSTS is enabled. A better idea would be that a HTTP request to a HSTS resource would instead fail completely with no recourse from the user other than manually typing https Before the url. But such things might endanger the usability.

No you dont need to worry. A site that wants to track you could aswell store your IP adress on server side to be able to show targeted ads and such. If you want to surf completely anonymously, for example via TOR, you should turn off HSTS completely, and instead itself be vary of SSLstrip by manually checking that HTTPS is being deployed.

Improve this answer
6
  • Interesting to see how this works. But in effect you say that for each bit, the browser needs a redirect to another page? Or is this operated in the background via javascript or iframe? It seems very inefficient.
    – SPRBRN
    Jan 19, 2015 at 15:57
  • doesnt matter. You could for example use a img src=00.example.org/img.jpg and then it redirects sufficently many times Before serving the Picture.
    – sebastian nielsen
    Jan 19, 2015 at 16:10
  • Note that turning off HSTS on your browser could make you vulnerable to cookie poisoning attacks. Also, a HSTS "super cookie" could be a longer term tracking tool than your IP address which is subject to change (either dynamically with your ISP, or if you log on from different locations).
    – SilverlightFox
    Jan 20, 2015 at 17:38
  • 5
    Failing all HTTP requests to a domain with an HSTS policy won't hide the fact that the client knows about the HSTS policy. It is easy for the server to tell the difference between a client which makes an HTTP request and one which does not make an HTTP request.
    – kasperd
    Jan 21, 2015 at 12:39
  • 1
    @kasperd: Agree, but with a small difference: The difference is that if the request fails, you as a web site cannot know if the failure is due to a network error or due to HSTS. About the second issue, HSTS wont solve that. What I mean is that its better to manually configure sites that should use HSTS instead of letting browser handle it, if you are afraid of "super cookies". There is extensions like HTTPS Everywhere and such, where you can configure where HTTPS is forced, manually.
    – sebastian nielsen
    Jan 21, 2015 at 15:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .