HTTP Strict Transport Security (HSTS) was designed to help secure websites (those that use HTTPS), by telling web browsers that they should only communicate over HTTPS with the server to protect connections from spoofing attacks and cookie theft.
Mozilla has supported HSTS in Firefox versions since 2014.
Ars Technica, meanwhile, was among the first to raise concerns about the HSTS feature in web browsers, as it allowed companies to implant supercookies into browsers using the same technology designed to improve end-user security.
For the record, you can check your browser on a demo website created by Sam Greenhalgh.
If you visit the website with a browser that supports HSTS, it will display a unique identifier that allows websites to track you.
Here we should mention that the problem is not limited to the Firefox web browser but also to Google Chrome and other browsers that use the HSTS feature.
But let's see what Firefox does with HSTS.
The Mozilla Foundation browser stores information from the HSTS function in SiteSecurityServiceState.txt, a file you will find in the path
C:\Users\iguru\AppData\Roaming\Mozilla\Firefox\Profiles\5f1kfxah.dev-edition-default
In the above path, instead of the user iguru, select the user you have on your PC. Also, the name of the last folder can be changed.
If you open the file with a plain text editor you will see a list of domain names, the prices associated with them, and an expiration date.
Let's now see how you can avoid being tracked by sites that use supercookies.
As you know, Firefox also has a private browsing mode.
With normal browsing mode: HSTS is stored on your computer, by every page that serves supercookies. Private browsing mode: however, deletes any HSTS information after the session.
HSTS Tracking Protection
1. Only use private browsing mode
Firefox will delete all HSTS information after you close the page. This is currently the best option to prevent supercookie tracking without risking your security.
To launch Firefox in private browsing mode, use the three-key combination Ctrl-Shift-P.
2. Delete all data stored on your computer after each web browsing session.
The second option is somewhat like this: Every time you close the Firefox browser, you should remember to delete the data that websites store on your computer. This way, along with everything else, the HSTS function data stored in the SiteSecurityServiceState.txt file will also be deleted.
3. Remove entries from the HSTS file manually
The HSTS file, SiteSecurityServiceState.txt, can be easily deleted using a simple text editor.
Make sure Firefox is closed before doing this.
This method gives you full control over the data stored in SiteSecurityServiceState.txt, but it requires manual intervention regularly, which may make it unsuitable.
4. Make the SiteSecurityServiceState.txt file read-only
This is the most radical approach as Firefox will not be able to write new HSTS information.
To make the file “read only” right-click on it in the file and select Properties from the menu. Tick the Read Only checkbox and click OK to apply the change.
