Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Firefox stores HSTS entries in a SQLite database, which you can query by running:

  echo "SELECT * FROM moz_hosts WHERE type='sts/use';" | sqlite3 permissions.sqlite
from inside your profile directory.

To clear HSTS entries (which the "Clear recent history" UI does not delete), you can do:

  echo "DELETE FROM moz_hosts WHERE type='sts/use';" | sqlite3 permissions.sqlite
I've been periodically monitoring this database for HSTS supercookies over the last couple years and have yet to see any in the wild.


They were recently moved to the SiteSecurityServiceState.txt file: https://bugzilla.mozilla.org/show_bug.cgi?id=775370


Good grief. They've replaced a SQLite database with a text file that's loaded into an in-memory hash table because "adoption of HSTS is not very widespread yet" so "using any kind of off-the-shelf database to store this would be inefficient and overly complex." This required a patch that took over a year to review, during which time issues were raised with the text file parser they had to write from scratch. Loading the whole table into memory has clear DoS implications, so they're limiting the table to 1024 entries (making the use of a hash table rather silly), with an eviction strategy[1] that is going to favor older entries and effectively prevent newer entries from being added.

[1] https://hg.mozilla.org/releases/mozilla-aurora/rev/b339d53f9...


Ran the above query on my Fx 34.0.5 profile, which is set to clear all history, cookies, cache, etc. on close of each session.

Among the entries was one named track.nextuser.com

"About NextUser: We believe every user should have an experience personalized for them..."

That doesn't sound very promising.


> Among the entries was one named track.nextuser.com

In order to be a supercookie they need more than one entry (since each entry only stores 1 bit of information). Do you see any other entries that look like they could be associated with this one?


Helpful. Thanks.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: