Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Issue 3419: Mitigate HSTS fingerprinting #1744

Merged
merged 2 commits into from
Mar 1, 2019
Merged

Issue 3419: Mitigate HSTS fingerprinting #1744

merged 2 commits into from
Mar 1, 2019

Commits on Feb 28, 2019

  1. Issue 3419: Disallow 3rd parties from setting HSTS. 

    HSTS supercookies are a known fingerprinting vector. This change disallow's
third parties from setting security headers:

1. "Strict-Transport-Security"
2. "Expect-CT"
3. "Public-Key-Pins"
4. "Public-Key-Pins-Report-Only"

that can be used for fingerprinting.

auditors: @diracdeltas, @bbondy, @iefremov
    @jumde
    jumde committed Feb 28, 2019
    Configuration menu
    Copy the full SHA
    f83d939 View commit details
    Browse the repository at this point in the history

  2. HSTS fingerprinting should not be tied to shield settings.

    @jumde
    jumde committed Feb 28, 2019
    Configuration menu
    Copy the full SHA
    80eaac6 View commit details
    Browse the repository at this point in the history