{"action":"created","issue":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/12223","repository_url":"https://api.github.com/repos/brave/browser-laptop","labels_url":"https://api.github.com/repos/brave/browser-laptop/issues/12223/labels{/name}","comments_url":"https://api.github.com/repos/brave/browser-laptop/issues/12223/comments","events_url":"https://api.github.com/repos/brave/browser-laptop/issues/12223/events","html_url":"https://github.com/brave/browser-laptop/issues/12223","id":280320337,"number":12223,"title":"mitigate HSTS fingerprinting","user":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars1.githubusercontent.com/u/549654?v=4","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"labels":[{"id":315504236,"url":"https://api.github.com/repos/brave/browser-laptop/labels/privacy","name":"privacy","color":"5319e7","default":false},{"id":314299292,"url":"https://api.github.com/repos/brave/browser-laptop/labels/security","name":"security","color":"eb6420","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/brave/browser-laptop/milestones/76","html_url":"https://github.com/brave/browser-laptop/milestone/76","labels_url":"https://api.github.com/repos/brave/browser-laptop/milestones/76/labels","id":2610473,"number":76,"title":"0.20.x (Beta Channel)","description":"\r\n\r\n\r\n","creator":{"login":"bsclifton","id":4733304,"avatar_url":"https://avatars3.githubusercontent.com/u/4733304?v=4","gravatar_id":"","url":"https://api.github.com/users/bsclifton","html_url":"https://github.com/bsclifton","followers_url":"https://api.github.com/users/bsclifton/followers","following_url":"https://api.github.com/users/bsclifton/following{/other_user}","gists_url":"https://api.github.com/users/bsclifton/gists{/gist_id}","starred_url":"https://api.github.com/users/bsclifton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsclifton/subscriptions","organizations_url":"https://api.github.com/users/bsclifton/orgs","repos_url":"https://api.github.com/users/bsclifton/repos","events_url":"https://api.github.com/users/bsclifton/events{/privacy}","received_events_url":"https://api.github.com/users/bsclifton/received_events","type":"User","site_admin":false},"open_issues":35,"closed_issues":409,"state":"open","created_at":"2017-06-28T18:37:32Z","updated_at":"2017-12-22T20:33:43Z","due_on":null,"closed_at":null},"comments":0,"created_at":"2017-12-07T23:47:47Z","updated_at":"2017-12-22T20:34:48Z","closed_at":null,"author_association":"OWNER","body":"context: it has been reported in various places that Criteo is using HSTS supercookies (where they buy a bunch of domains and set HSTS on a different subset of domains for each user in order to uniquely identify them) for ad tracking. https://www.gothamcityresearch.com/single-post/2017/10/12/Criteo-SA-NASDAQ-CRTO-Why-We-Believe-Criteo%E2%80%99s-Undisclosed-Practices-are-Illegal-and-Harmful-to-Advertisers\r\n\r\npossibilities:\r\n1. double-key HSTS\r\n2. disallow 3rd parties from setting HSTS\r\n"},"comment":{"url":"https://api.github.com/repos/brave/browser-laptop/issues/comments/353670524","html_url":"https://github.com/brave/browser-laptop/issues/12223#issuecomment-353670524","issue_url":"https://api.github.com/repos/brave/browser-laptop/issues/12223","id":353670524,"user":{"login":"diracdeltas","id":549654,"avatar_url":"https://avatars1.githubusercontent.com/u/549654?v=4","gravatar_id":"","url":"https://api.github.com/users/diracdeltas","html_url":"https://github.com/diracdeltas","followers_url":"https://api.github.com/users/diracdeltas/followers","following_url":"https://api.github.com/users/diracdeltas/following{/other_user}","gists_url":"https://api.github.com/users/diracdeltas/gists{/gist_id}","starred_url":"https://api.github.com/users/diracdeltas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/diracdeltas/subscriptions","organizations_url":"https://api.github.com/users/diracdeltas/orgs","repos_url":"https://api.github.com/users/diracdeltas/repos","events_url":"https://api.github.com/users/diracdeltas/events{/privacy}","received_events_url":"https://api.github.com/users/diracdeltas/received_events","type":"User","site_admin":false},"created_at":"2017-12-22T20:34:48Z","updated_at":"2017-12-22T20:34:48Z","author_association":"OWNER","body":"adding to 0.20.x, per @BrendanEich suggestion\r\n\r\ncurrently the proposal seems to boil down to: don't apply HSTS on 3rd party subresource loads, unless that subresource has been visited as a first party (similar to Safari's 3rd party cookie policy)"}}
{"actor":{"display_login":"diracdeltas"}}