2

The TorBrowser will honor HSTS settings during a session, meaning that if you visit an HTTPS site and the HSTS flag is set, the browser will not allow an HTTP downgrade. Does this survive across restarts?

2

According to this test site, HSTS information does not survive a reboot on TBB 4.5 nor TBB 5 Alpha supported. This is probably because HSTS can be used to track browsers. It sounds as if the preload list will be supported and should protect users of major websites that enable HSTS.

  • 1
    Note the preload list has certain caveats, so not all HSTS sites will be included. – Andrew Lott Jul 17 '15 at 14:14
  • @AndrewLott Have any useful links? I would love to link to the policy if it is laid out somewhere.... – Indolering Jul 26 '15 at 22:57
  • hstspreload.appspot.com details the requirements. – Andrew Lott Jul 26 '15 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.