W3C home > Mailing lists > Public > public-webappsec@w3.org > September 2014

Re: Redirects and HSTS

From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 26 Sep 2014 22:07:10 +0200
Message-ID: <CADnb78hqB3SiVH5VqdaQDUfhWstP_TzJSiUN9W3HdVfusJmJYg@mail.gmail.com>
To: Ryan Sleevi <sleevi@google.com>
Cc: Mike West <mkwst@google.com>, Tanvi Vyas <tanvi@mozilla.com>, WebAppSec WG <public-webappsec@w3.org>
On Fri, Sep 26, 2014 at 8:27 PM, Ryan Sleevi <sleevi@google.com> wrote:
> If I understand Anne's point, the question is: Can HSTS be used for
> tracking? The answer is Yes, and this is (briefly) discussed in Section 14.9
> of RFC 6797 ( http://tools.ietf.org/html/rfc6797#section-14.9 ), and, as
> Chris notes later in this thread, expanded upon in the context of HPKP to
> explicitly document the attack (as it also exists for HPKP, although
> slightly differently)

That does seem to cover it, although the first sentence makes it sound
more difficult than it really is.

Received on Friday, 26 September 2014 20:07:38 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 18:54:40 UTC