Re: HSTS Misuse

Talking about hsts misuse we should not forget the so-called hsts
supercookies, which obviously makes no sense from a technical perspective
but the point that hsts can be used for tracking still stands.
What to do about that?

Unlike cookies, hsts cannot be easily purged by the user.
Am 22.05.2016 15:51 schrieb "Dennis Olvany" <dennisolvany@gmail.com>:

> There is a section in the RFC that addresses DoS, but I am interested in a
> particular case. Let's posit that a domain owner directs their domain to an
> https server that returns an HSTS header without the domain owner's
> knowledge or consent. If the domain owner then directs their domain to an
> http server, the site will be unreachable from browsers that are caching
> HSTS. Has there been any discussion or guidance regarding this scenario?
> When is the implementation of HSTS considered to be inappropriate?
>