Re: Super Cookies in Privacy Browsing mode

Thanks Rigo - interesting article. 

If I read it correctly, the offending flag is set when the browser is in “normal” mode, and the vulnerability introduced by it is that it persists if the user switches to private browsing mode without first flushing the cookies accumulated while in “normal” mode. Doing that when you switch modes is a hassle, but then, so is cleaning your teeth - and both are good hygiene ;^)

Presumably another workable option is to have multiple browser instances, and to ensure that at least one is always set to private mode (so that you’re not switching from normal to private in the same browser).

R

Robin Wilton
Technical Outreach Director - Identity and Privacy
Internet Society

email: wilton@isoc.org
Phone: +44 705 005 2931
Twitter: @futureidentity

On 8 Jan 2015, at 20:56, Rigo Wenning <rigo@w3.org> wrote:

> And here is the link after popular demand :( Sorry that I missed it..
> 
> http://arstechnica.com/security/2015/01/browsing-in-privacy-mode-super-cookies-can-track-you-anyway/
> 
> On Thursday 08 January 2015 21:13:27 Rigo Wenning wrote:
>> Happy New Year!
>> 
>> Interesting article about how HTTP Strict Transport Security can be used to
>> circumvent the protections in the private browsing mode. But it seems to be
>> fixed in firefox >34. I don't know about the other browsers.
>> 
>> --Rigo